renovate: termix customManager — use regex versioning instead of loose+extractVersion

Third attempt. Debug run confirmed `loose` + `extractVersion` STILL produces:

  DEBUG: Dependency Termix-SSH/Termix has unsupported/unversioned value
         release-1.11.0 (versioning=loose)
  DEBUG: Skipping Termix-SSH/Termix because no currentDigest or pinDigests

`extractVersion` is only applied to CANDIDATE versions (from the datasource),
not to currentValue. Renovate's pre-validation runs the raw `release-1.11.0`
through `loose`, which can't parse it (the `release-` prefix breaks semver
detection), so Renovate falls back to digest-only and gives up.

`regex` versioning is the only mode that parses the prefixed value directly
(no extractVersion needed) — Renovate's regex.matches() accepts `release-1.11.0`
because the rule's pattern captures the whole tag. github-releases datasource
returns the upstream `release-X.Y.Z` tag_names which the same regex parses.
No conversion needed; the new tag written back to the manifest is the same
`release-X.Y.Z` form, valid in the ghcr.io/lukegus/termix registry.

Removes extractVersionTemplate (no longer needed).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

admin-system/renovate.yaml

@@ -44,12 +44,25 @@ data:
       "requireConfig": "optional",
       "dependencyDashboard": true,
       "dependencyDashboardTitle": "Renovate Dependency Dashboard",
-      "prHourlyLimit": 8,
+      "prHourlyLimit": 16,
-      "prConcurrentLimit": 8,
+      "prConcurrentLimit": 16,
-      "enabledManagers": ["kubernetes", "helm-values"],
+      "enabledManagers": ["kubernetes", "helm-values", "custom.regex"],
       "kubernetes": {
         "managerFilePatterns": ["/.+\\.ya?ml$/"]
       },
+      "customManagers": [
+        {
+          "description": "termix uses a release-X.Y.Z prefixed tag. extractVersion + loose doesn't work because Renovate validates the raw currentValue BEFORE applying extractVersion. Using regex versioning (which parses the prefixed value directly) sidesteps the pre-check. Datasource redirected to GitHub Releases at Termix-SSH/Termix so the 3-day stability gate has real timestamps to work with.",
+          "customType": "regex",
+          "managerFilePatterns": ["/termix-system/.+\\.ya?ml$/"],
+          "matchStrings": [
+            "image:\\s+(?<depName>ghcr\\.io/lukegus/termix):(?<currentValue>release-\\d+\\.\\d+\\.\\d+)"
+          ],
+          "datasourceTemplate": "github-releases",
+          "packageNameTemplate": "Termix-SSH/Termix",
+          "versioningTemplate": "regex:^release-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$"
+        }
+      ],
       "packageRules": [
         {
           "description": "All apps: 3-day stability gate before any PR opens",
@@ -90,17 +103,16 @@ data:
           ],
           "automerge": false
         },
-        {
-          "description": "termix: use github-releases as datasource (ghcr.io OCI manifest for this image lacks the release timestamp Renovate needs for the stability gate; GitHub Releases at Termix-SSH/Termix expose proper timestamps so the 3-day gate works as intended). regex versioning parses the release-X.Y.Z prefix. Renovate still writes the new tag to the same ghcr.io/lukegus/termix image (the registry hosts every release).",
-          "matchPackageNames": ["ghcr.io/lukegus/termix"],
-          "datasource": "github-releases",
-          "packageName": "Termix-SSH/Termix",
-          "versioning": "regex:^release-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$"
-        },
         {
           "description": "wanderer: db + web update together in one PR",
           "matchPackageNames": ["flomp/wanderer-db", "flomp/wanderer-web"],
           "groupName": "wanderer"
+        },
+        {
+          "description": "termix: kubernetes manager would extract the image with versioning=docker and silently skip it (release-1.11.0 fails the docker pre-check). Disable that extraction; customManagers above does the real work via github-releases.",
+          "matchManagers": ["kubernetes"],
+          "matchPackageNames": ["ghcr.io/lukegus/termix"],
+          "enabled": false
         }
       ],
       "labels": ["renovate"]

termix-system/termix.yaml

@@ -41,6 +41,10 @@ spec:
     spec:
       containers:
         - name: termix
+          # NOTE: termix uses a non-semver tag pattern (release-X.Y.Z).
+          # Renovate handles it via a customManagers regex defined in
+          # admin-system/renovate.yaml (the kubernetes manager doesn't
+          # process inline `# renovate:` comments).
           image: ghcr.io/lukegus/termix:release-1.11.0
           imagePullPolicy: IfNotPresent
           ports: