renovate: termix via inline manifest comment (packageRule was applied too late)

Debug-level dry-run revealed why the previous packageRule approach
(`datasource: github-releases` + `packageName: Termix-SSH/Termix` +
`versioning: regex:^release-...`) silently did nothing:

  DEBUG: Dependency ghcr.io/lukegus/termix has unsupported/unversioned
         value release-1.11.0 (versioning=docker)
  DEBUG: Skipping ghcr.io/lukegus/termix because no currentDigest or
         pinDigests

The kubernetes manager extracts the image with the default versioning
(=docker), runs an EARLY currentValue pre-check, fails on `release-1.11.0`,
falls back to digest-based updates, and gives up -- all BEFORE the
packageRule's `versioning` override has a chance to apply. Same failure
class as the earlier `extractVersion` attempt.

Renovate's documented fix for this exact case is an inline manifest
comment that applies overrides at extraction time:

  # renovate: datasource=github-releases depName=Termix-SSH/Termix \
  #          versioning=loose extractVersion=^release-(?<version>.+)$
  image: ghcr.io/lukegus/termix:release-1.11.0

With extractVersion stripping the `release-` prefix at extraction, the
loose semver parser handles the resulting `1.11.0` / `2.3.2` fine.
github-releases datasource gives Renovate real upstream timestamps so
the 3-day stability gate works normally. Removing the now-superseded
packageRule keeps the config clean (6 rules instead of 7).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

admin-system/renovate.yaml

@@ -90,13 +90,6 @@ data:
           ],
           "automerge": false
         },
-        {
-          "description": "termix: use github-releases as datasource (ghcr.io OCI manifest for this image lacks the release timestamp Renovate needs for the stability gate; GitHub Releases at Termix-SSH/Termix expose proper timestamps so the 3-day gate works as intended). regex versioning parses the release-X.Y.Z prefix. Renovate still writes the new tag to the same ghcr.io/lukegus/termix image (the registry hosts every release).",
-          "matchPackageNames": ["ghcr.io/lukegus/termix"],
-          "datasource": "github-releases",
-          "packageName": "Termix-SSH/Termix",
-          "versioning": "regex:^release-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$"
-        },
         {
           "description": "wanderer: db + web update together in one PR",
           "matchPackageNames": ["flomp/wanderer-db", "flomp/wanderer-web"],

termix-system/termix.yaml

@@ -41,6 +41,7 @@ spec:
     spec:
       containers:
         - name: termix
+          # renovate: datasource=github-releases depName=Termix-SSH/Termix versioning=loose extractVersion=^release-(?<version>.+)$
           image: ghcr.io/lukegus/termix:release-1.11.0
           imagePullPolicy: IfNotPresent
           ports: