fix(renovate): use a flexible internal-checks filter so ages resolve

Age came back `unknown` for every dependency, which is the previous
commit's `internalChecksFilter: none` doing exactly what it says on the
tin — and rather more. filter-checks.ts short-circuits on `none`:

    if (internalChecksFilter === 'none') {
      release = sortedReleases.pop();     // returns here
    } else {
      for (let candidateRelease of sortedReleases.reverse()) {
        ...
        const updatedCandidateRelease = await postprocessRelease(...)

postprocessRelease is the only caller that fetches a Maven artifact's
Last-Modified header, so skipping the loop leaves releaseTimestamp unset.
That empties the Age column, but it also silently voids minimumReleaseAge
and the stability status check, since both compare against that same
timestamp. The cooling-off tiers were decorative.

`flexible` keeps the intent — it still prefers a version that has cleared
its window, but opens the PR at the newest candidate when none has — while
running the loop that populates the timestamps. Verified with a local
dry-run: compose-bom 24 d, material3 1.5.0-alpha24 10 d, work-runtime
122 d, AGP 9.3.1 2 d, gradle 29 d. Only ghcr.io/renovatebot/renovate stays
unknown, because the docker registry serves no timestamps at all — the
run marks all 176 of its tags pending for that reason, and flexible is
what still lets that PR through.

Pending rejoins the table: under a flexible filter it names the newer
version being held back, rather than leaving it invisible.

Also migrates the Gitea workflow manager off the deprecated `fileMatch`.
Renovate's config migration was rewriting it to `managerFilePatterns`
(delimited regex) on every run and warning about it; the dry-run confirms
the manager still picks up .gitea/workflows afterwards.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

renovate.json5

@@ -33,14 +33,20 @@
   // One reviewable surface; the dashboard issue lists everything pending.
   dependencyDashboard: true,
 
-  // The cooling-off periods below are advisory, not a gate: "none" turns off
+  // The cooling-off periods below are advisory, not a gate. "flexible" still
-  // filtering on the minimumReleaseAge check, so the PR is opened at the
+  // prefers a version that has cleared its window, but when every candidate is
-  // highest version straight away and merging early stays a judgement call.
+  // too young it opens the PR at the newest one anyway, so merging early stays
-  // (Renovate's default here is "strict", which suppresses the PR entirely
+  // a judgement call. (The default, "strict", would suppress the PR entirely
-  // until the release has aged in.) A still-young release carries a pending
+  // until a release aged in.) A still-young branch carries a yellow
   // `renovate/stability-days` check so it's visible which side of the line
   // it's on; with automerge off, nothing acts on that check by itself.
-  internalChecksFilter: "none",
+  //
+  // NOT "none": that short-circuits the candidate loop in filter-checks.ts, and
+  // that loop is what calls postprocessRelease — the only thing that fetches a
+  // Maven artifact's Last-Modified header. Skipping it leaves releaseTimestamp
+  // unset, which empties the Age column and quietly makes minimumReleaseAge and
+  // the stability check no-ops, since both need that timestamp to compare.
+  internalChecksFilter: "flexible",
 
   labels: ["dependencies"],
   prConcurrentLimit: 5,
@@ -52,8 +58,10 @@
 
   // Gitea Actions workflows live under .gitea/workflows, not .github — extend
   // the github-actions manager (same syntax) to watch them too.
+  // `fileMatch` is deprecated; the replacement takes the regex delimited, and
+  // Renovate's config migration was already rewriting this on every run.
   "github-actions": {
-    fileMatch: ["^\\.gitea/workflows/[^/]+\\.ya?ml$"],
+    managerFilePatterns: ["/^\\.gitea/workflows/[^/]+\\.ya?ml$/"],
   },
 
   packageRules: [
@@ -100,9 +108,12 @@
     // deps, and the Gradle wrapper / Actions / container bumps would keep the
     // default columns and show no age at all. A rule declared after it wins,
     // and gives every PR the same table.
+    // "Pending" earns its place under a flexible filter: when the bump lands on
+    // a version that has cleared its window but a newer one hasn't, that newer
+    // version is named here rather than silently withheld.
     {
       matchPackageNames: ["*"],
-      prBodyColumns: ["Package", "Type", "Change", "Age", "Confidence"],
+      prBodyColumns: ["Package", "Type", "Change", "Age", "Pending", "Confidence"],
     },
   ],
 }