renovate: switch termix rule to regex versioning (loose+extractVersion silently skipped it)

Debug-level dry-run showed:
  Dependency ghcr.io/lukegus/termix has unsupported/unversioned value
  release-1.11.0 (versioning=loose)
  Skipping ghcr.io/lukegus/termix because no currentDigest or pinDigests

`versioning: loose + extractVersion` doesn't work as intended here:
Renovate evaluates the currentValue (`release-1.11.0`) against the loose
parser BEFORE extractVersion is applied. loose can't parse a prefixed
value, so Renovate falls back to digest-based comparison; we don't pin
digests, so it silently skips and no PRs are ever opened. (Upstream has
v1.11.1, v1.11.2, and a major bump to release-2.3.2 since we deployed.)

Fix: use `versioning: regex:^release-(?<major>\d+)\.(?<minor>\d+)\.(?<patch>\d+)$`
which parses the whole tag including the `release-` prefix. The named
major/minor/patch groups let Renovate categorize bumps correctly so
the existing minor/patch automerge and major dashboard-approval rules
apply normally.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

admin-system/renovate.yaml

@@ -91,10 +91,9 @@ data:
           "automerge": false
         },
         {
-          "description": "termix: non-semver release- tag",
+          "description": "termix: non-semver release-X.Y.Z tag (regex versioning parses the whole tag incl. prefix; loose+extractVersion silently skips because currentValue fails the loose parser before extractVersion is applied)",
           "matchPackageNames": ["ghcr.io/lukegus/termix"],
-          "versioning": "loose",
+          "versioning": "regex:^release-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$"
-          "extractVersion": "^release-(?<version>.+)$"
         },
         {
           "description": "wanderer: db + web update together in one PR",