ci: converge this runner check on the proven one

[tannevaled]

The workflow that runs Renovate for this organisation is renovate.yml. This repository carries a shorter ci.yml that checks it; the fleet is being converged on one file so that every runner is checked the same way.

Three of the differences are substantive: the self-test, top-level extends resolution, and curl -sSfL where the shorter file used -sSL (curl exits 0 on an HTTP error and pipes the error page onward).

This replaces it with the proven file.

Every step states what it proves and what it does not:

1. Workflows parse — actionlint. Does not prove any referenced action exists.
2. Every pinned action ref exists — via git ls-remote, so no token and no API budget. This is the step with teeth on the pull requests that actually arrive here.
3. The Renovate config validates, as the container sees it — config.js as global config and default.json/renovate.json as repo config, each validated alone in an empty directory, because renovatebot/github-action mounts the configuration file by itself.
4. The validator still rejects a bad config — a self-test. Step 3 is fed a known-bad config and the run fails if that config is accepted, so the check cannot quietly become an alibi.
5. Every top-level extends preset resolves — the one case the validator provably skips.

Two limits of renovate-config-validator are documented in the file rather than glossed, both re-measured against renovate@latest at [2026-08-31 19:37:55 CEST]: it does not catch "matchUpdateTypes": "minor" where an array is required, and it does not resolve a top-level extends, which is the only form this fleet uses. A check whose blind spots are unstated converts an absence into false assurance.

--dry-run was measured and rejected: it is not architecturally read-only.

Prepared [2026-08-31 19:37:55 CEST]. All five steps were run locally against this repository before this branch was pushed, and the self-test was verified to fail on a known-bad config.