ci: consolidate cicd workflow lanes, clean up helpers, and align CI docs (#86)

## Summary
This PR simplifies the CICD workflow by merging related lanes, reducing duplicated script logic, and keeping the same overall pipeline behavior and gates. It also updates CI documentation to match the new job topology.

## What Changed

### Workflow consolidation
- Merged base and complete CICD image publication into one producer job:
  - Build and Push CICD Images
- Merged dependency audits into one informational lane:
  - Dependency Audits (Informational)
- Merged runtime image build lanes into one release producer:
  - Build Release Images
- Merged tester image build lanes into one tester producer:
  - Build Tester Images

### Dependency/gate rewiring
- Updated downstream needs to consume merged producers.
- Kept output contracts for deployable and tester image references.
- Updated production and postmortem gates to the new job IDs.

### Cleanup/simplification
- Removed duplicate helper-function definition(s) in CICD scripts.
- Replaced a manual docker login retry loop with existing retry helper usage.
- Removed redundant shell option declarations where behavior was unchanged.
- Removed one unused E2E environment variable.

### Documentation alignment
- Updated CI architecture documentation to reflect merged workflow lanes.
- Updated troubleshooting guidance to reference current job sequencing.

## Why
- Reduce job startup overhead on self-hosted runners.
- Keep behavior consistent while lowering workflow complexity.
- Improve maintainability by removing duplicated/unused script fragments.
- Keep docs in sync with operational workflow reality.

## Validation
- Workflow file checks passed with pre-commit.
- Documentation checks passed with pre-commit (including markdownlint/prettier).
- No diagnostics/errors reported for updated workflow/docs files.

## Risk and Impact
- Low-to-medium operational risk due to job-ID/needs rewiring.
- Mitigated by preserving output keys consumed by integration and e2e lanes.
- Audit lane remains informational-only (non-blocking), same intent as before.

Co-authored-by: copilotcoder <copilotcoder@darkhelm.org>
Reviewed-on: #86

docs/RENOVATE_SETUP_GUIDE.md

@@ -4,6 +4,25 @@
 
 Renovate is an automated dependency update tool that creates pull requests to keep your project dependencies up to date. This guide covers setting up Renovate for the plex-playlist project with optimal configuration.
 
+## Repository Current Mode (2026-07)
+
+This repository runs Renovate through `.gitea/workflows/renovate.yml`.
+
+Current operational behavior:
+
+1. Uses `ubuntu-act-8gb` runner due to npm/registry memory pressure.
+2. Prepares Renovate container image with mirror-first strategy:
+
+- primary: `kankali.darkhelm.lan:3001/darkhelm.org/renovate:41`
+- fallback: `ghcr.io/renovatebot/renovate:41`
+
+3. Uses digest-aware freshness checks before deciding whether local cached image is current.
+4. Selects endpoint dynamically between internal and external candidates based on preflight reachability.
+5. Selects token via preflight checks (repo access required) with fallback order from configured secrets.
+6. Uses constrained memory settings (`RENOVATE_NODE_ARGS`) and disables OSV alerts in this runner profile.
+
+Treat workflow behavior as source of truth; use this doc as operator guidance.
+
 ## Setup Options
 
 ### Option 1: GitHub App (Recommended for GitHub)
@@ -89,7 +108,7 @@ on:
 
 jobs:
   renovate:
-    runs-on: ubuntu-act
+    runs-on: ubuntu-act-8gb
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -101,7 +120,7 @@ jobs:
           token: ${{ secrets.RENOVATE_TOKEN }}
         env:
           RENOVATE_PLATFORM: gitea
-          RENOVATE_ENDPOINT: https://dogar.darkhelm.org/api/v1
+          RENOVATE_ENDPOINT: selected at runtime from internal/external candidates
 ```
 
 ## Configuration Explanation
@@ -204,6 +223,37 @@ docker run --rm \
 4. **Large Updates**: Major version updates may need manual review
 5. **Docker Registry**: Ensure base image updates don't break builds
 
+### Current Workflow-Specific Failures
+
+1. **Renovate image pull failures**
+
+- Symptom: both mirror and GHCR candidates fail.
+- Check: runner DNS/egress and registry auth token validity.
+
+2. **Endpoint preflight failures**
+
+- Symptom: cannot reach both internal and external API endpoints.
+- Check: endpoint host mapping, TLS mode, and runner network route.
+
+3. **Token access failures**
+
+- Symptom: API `/repos/<org>/<repo>` check returns non-200.
+- Check: token scopes and secret ordering.
+
+4. **OOM or abrupt termination**
+
+- Symptom: process exits under memory pressure.
+- Check: `RENOVATE_NODE_ARGS`, PR concurrency limits, and optional feature toggles.
+
+## Operator Notes
+
+For this repository, prefer updating `.gitea/workflows/renovate.yml` over local one-off Renovate service changes. Keep docs and workflow in sync after changing:
+
+- endpoint selection logic
+- token preflight/fallback order
+- image source policy (mirror/fallback)
+- memory and concurrency guardrails
+
 ### Quick Validation
 
 For basic JSON validation without installing Renovate: