Merge pull request 'renovate: termix customManager regex versioning (loose+extractVersion still failing)' (#65) from feat/renovate-termix-regex-versioning into main

Third attempt. Debug run confirmed `loose` + `extractVersion` STILL produces:

  DEBUG: Dependency Termix-SSH/Termix has unsupported/unversioned value
         release-1.11.0 (versioning=loose)
  DEBUG: Skipping Termix-SSH/Termix because no currentDigest or pinDigests

`extractVersion` is only applied to CANDIDATE versions (from the datasource),
not to currentValue. Renovate's pre-validation runs the raw `release-1.11.0`
through `loose`, which can't parse it (the `release-` prefix breaks semver
detection), so Renovate falls back to digest-only and gives up.

`regex` versioning is the only mode that parses the prefixed value directly
(no extractVersion needed) — Renovate's regex.matches() accepts `release-1.11.0`
because the rule's pattern captures the whole tag. github-releases datasource
returns the upstream `release-X.Y.Z` tag_names which the same regex parses.
No conversion needed; the new tag written back to the manifest is the same
`release-X.Y.Z` form, valid in the ghcr.io/lukegus/termix registry.

Removes extractVersionTemplate (no longer needed).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

admin-system/renovate.yaml

@@ -52,7 +52,7 @@ data:
       },
       "customManagers": [
         {
-          "description": "termix uses a release-X.Y.Z prefixed tag that the kubernetes manager's docker-versioning pre-check rejects (so no PRs are ever created). This customManager extracts the image directly, redirects the version lookup to GitHub Releases at Termix-SSH/Termix (which exposes timestamps the 3-day stability gate needs), and uses extractVersion to strip the `release-` prefix so loose semver can parse it.",
+          "description": "termix uses a release-X.Y.Z prefixed tag. extractVersion + loose doesn't work because Renovate validates the raw currentValue BEFORE applying extractVersion. Using regex versioning (which parses the prefixed value directly) sidesteps the pre-check. Datasource redirected to GitHub Releases at Termix-SSH/Termix so the 3-day stability gate has real timestamps to work with.",
           "customType": "regex",
           "managerFilePatterns": ["/termix-system/.+\\.ya?ml$/"],
           "matchStrings": [
@@ -60,8 +60,7 @@ data:
           ],
           "datasourceTemplate": "github-releases",
           "packageNameTemplate": "Termix-SSH/Termix",
-          "versioningTemplate": "loose",
+          "versioningTemplate": "regex:^release-(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)$"
-          "extractVersionTemplate": "^release-(?<version>.+)$"
         }
       ],
       "packageRules": [
@@ -158,7 +157,7 @@ spec:
           restartPolicy: OnFailure
           containers:
             - name: renovate
-              image: renovate/renovate:43.197.0
+              image: renovate/renovate:43.209.3
               imagePullPolicy: IfNotPresent
               envFrom:
                 - secretRef:

admin-system/tailscale.yaml

@@ -90,7 +90,7 @@ spec:
       dnsPolicy: ClusterFirstWithHostNet
       containers:
         - name: tailscale
-          image: tailscale/tailscale:v1.94.1
+          image: tailscale/tailscale:v1.98.4
           imagePullPolicy: IfNotPresent
           env:
             - name: TZ

helm/plex/values.yaml

@@ -181,7 +181,7 @@ rclone:
     registry: index.docker.io
     repository: rclone/rclone
     # -- If unset use latest
-    tag: 1.74.2
+    tag: 1.74.3
     sha: ""
     pullPolicy: IfNotPresent
 

mon-system/monitoring.yaml

@@ -529,7 +529,7 @@ spec:
         runAsGroup: 472
       containers:
         - name: grafana
-          image: grafana/grafana:13.0.2
+          image: grafana/grafana:12.4.4
           ports:
             - containerPort: 3000
               name: http

orsi-system/filebrowser.yaml

@@ -89,7 +89,7 @@ spec:
       initContainers:
         # Configure proxy auth in database before starting
         - name: configure-auth
-          image: filebrowser/filebrowser:v2.63.5
+          image: filebrowser/filebrowser:v2.63.13
           command:
             - sh
             - -c
@@ -109,7 +109,7 @@ spec:
             runAsGroup: 1001
       containers:
         - name: filebrowser
-          image: filebrowser/filebrowser:v2.63.5
+          image: filebrowser/filebrowser:v2.63.13
           command:
             - filebrowser
             - --database=/config/filebrowser.db

tandoor-system/tandoor.yaml

@@ -30,7 +30,7 @@ spec:
     spec:
       initContainers:
         - name: create-superuser
-          image: vabene1111/recipes:2.5
+          image: vabene1111/recipes:2.6
           workingDir: /opt/recipes
           command:
             - /bin/sh
@@ -106,7 +106,7 @@ spec:
                   key: email
       containers:
         - name: tandoor
-          image: vabene1111/recipes:2.5
+          image: vabene1111/recipes:2.6
           imagePullPolicy: IfNotPresent
           env:
             - name: TZ

vaultwarden-system/vaultwarden.yaml

@@ -28,7 +28,7 @@ spec:
     spec:
       containers:
         - name: vaultwarden
-          image: vaultwarden/server:1.35.2
+          image: vaultwarden/server:1.36.0
           imagePullPolicy: IfNotPresent
           env:
             - name: TZ

web-system/web.yaml

@@ -130,7 +130,7 @@ spec:
       initContainers:
         # Configure proxy auth in database before starting
         - name: configure-auth
-          image: filebrowser/filebrowser:v2.63.5
+          image: filebrowser/filebrowser:v2.63.13
           command:
             - sh
             - -c
@@ -151,7 +151,7 @@ spec:
             runAsGroup: 1000
       containers:
         - name: filebrowser
-          image: filebrowser/filebrowser:v2.63.5
+          image: filebrowser/filebrowser:v2.63.13
           command:
             - filebrowser
             - --database=/config/filebrowser.db