feat(renovate): track the RigelBuild/devenv fork in both devenv locks (RIG-2815) - #865

… + accurate fail-loud (RIG-2815)

Round-1 review of PR #865 returned 2 high + 4 medium + 4 low. This additive
commit dispositions them; the structural H1 gap is filed as RIG-3253.

H2 (high) — the agent-image relock ran under the ROOT lock's devenv CLI
(renovate.yml provisions one PATH devenv from devenv.lock). refresh-devenv-lock.ts
now self-provisions the scope-correct devenv: `const src = flakeref(devenvSource(before))`
then `nix run ${src} -- update devenv` in the scope dir, reusing devenvSource/flakeref
from tools/toolchain/devenv-cli/core.ts (mirrors ci.yml:2058-2059). Each lock is now
written by the devenv version IT pins — the two revs differ by design (RD-1).

H1 (high) — the "fail-loud refuses to ship" comments/messages overclaimed. Verified
against renovate@44.46.2: a non-zero postUpgradeTask exit does NOT abort the branch
(execute-post-upgrade-commands.js:112-117 → artifactErrors; branch/index.js:408-417
reaches MANAGER_LOCKFILE_ERROR only in the releaseTimestamp arm, absent for a git-refs
digest; prepareCommit reset --hard re-writes the in-memory rev-bump). Corrected every
comment/message to state the real effect — a red renovate/artifacts status — and that
the fail-closed guarantee is that status + mandatory human review (no automerge). Throws
kept. Making renovate/artifacts a required check / adding a devenv-fork consistency CI
gate is the family-wide structural fix, filed as RIG-3253.

M1 — escape the interior slash in the agent-image managerFilePattern; pin the literal
in config.test.ts. M2 — loud named failure when neither origin/<base> nor <base>
resolves, instead of a raw git diff error; + fallback-direction and unresolvable-base
tests. M3 — nix test stub gates the lock write on the post-`--` args being exactly
`update devenv`; + fail-relock and corrupt-relock sentinel tests. M4 — correct the
minimumReleaseAge:null justification (mechanically inapplicable to a git-refs digest;
compensating control is human review). L1 isolation-chain comment; L2 readonly
DEVENV_LOCK_PATHS; L3 hoist beforeRev out of the log template.

moon run renovate:typecheck renovate:test → 152 pass / 0 fail (4 new tests). Biome
clean on touched files (2 pre-existing config.test.ts warnings, identical on main).

… substituter coupling guard (RIG-2815)

Round-2 review of the R1 fixes (0 high / 2 medium / 3 low) surfaced two
runtime-surface gaps introduced by the R1 relock rework, plus follow-on
review of these fixes (R3) hardened them:

- executionTimeout: 45 (bot-config.json5, globalOnly) so the fork-devenv
  relock — which cold-builds the fork `#devenv` from source, no binary
  cache — is not killed at Renovate's 15-min child-process default, which
  would leave the regex rev bump committed but the lock unrelocked. Comment
  states the knob's GLOBAL scope (raises the hang budget for every manager,
  accepted deliberately) and cites the fork's own ~4.5-min ubuntu-latest
  build. Pinned by a config.test.ts assertion (floor >= 30, mutation-killed
  on removal and on a lowered value).

- Substituter-coupling header note on refresh-devenv-lock.ts + a
  config.test.ts guard that renovate.yml's extra_nix_config still names both
  caches and both trusted keys on LIVE (comment-stripped) config lines, so a
  future trim — including a commented-out or narrated-away block — fails the
  test rather than silently wedging the nightly relock.

- Test hardening: a base-ref direction test where both origin/main and a
  stale local main resolve-and-differ (the prior test passed with the arms
  flipped); a mandatory `--` separator in the nix stub; and a matchStrings
  sync guard across the two fork managers.

Co-authored-by: Matt Wilkinson <matt@rigel.build>