Auto-regenerate gh-aw lock files in renovate PRs

[trask]

Generalizes the former auto-license-report workflow into a broader auto-post-renovate workflow that regenerates anything Renovate cannot regenerate on its own, and teaches Renovate about the gh-aw workflow source files.

Background

Renovate manages .github/workflows/*.lock.yml via the built-in github-actions manager (it rewrites SHA pins inside the generated lock files), but it cannot:

1. Re-run gh aw compile to keep .github/aw/actions-lock.json and the lock files internally consistent.
2. Bump the gh extension install github/gh-aw --pin vX.Y.Z argument in build-common.yml (the gh-aw CLI version) to match the new gh-aw-actions version.
3. See the gh-aw workflow source files (.github/workflows/*.md), since Renovate's github-actions manager only scans .yml / .yaml. This meant any SHA Renovate rewrote in a *.lock.yml would be reverted on the next gh aw compile run.

CI failure example: #18850.

Changes

.github/workflows/auto-post-renovate.yml (renamed from auto-license-report.yml)

On every push to a renovate/** branch, regenerates auto-managed files and pushes any diff back to the Renovate branch:

• ./gradlew generateLicenseReport (existing).
• Detect the latest gh-aw-actions version from *.lock.yml (set by Renovate), sed-replace the matching --pin in build-common.yml, install that pinned gh-aw CLI, then gh aw compile (without --no-check-update, so it refreshes actions-lock.json).

.github/renovate.json5

Adds a 4th customManager (regex, github-tags datasource) targeting .github/workflows/*.md so Renovate sees uses: owner/repo@<sha> # vX.Y.Z references in the gh-aw workflow source files. The regex tolerates 3-segment paths like gradle/actions/setup-gradle by collapsing them to the owner/repo form the datasource expects.

The existing weekly-update grouping rule already covers custom.regex, so these PRs are batched into the same weekly bundle as the github-actions/dockerfile updates.

.github/workflows/pr-review.md

Normalizes 5 uses: lines from bare tag form (actions/checkout@v6.0.2) to SHA-pinned-with-comment form (actions/checkout@<sha> # v6.0.2) so the new customManager regex covers them. The 4 SHAs that already matched the generated lock file are used as-is; upload-artifact@v5 is replaced with the pinned v7.0.1 used everywhere else in the repo.

End-to-end flow

1. Renovate bumps an action → opens PR with edits in both the .md source (new customManager) and .lock.yml (built-in manager).
2. auto-post-renovate.yml runs gh aw compile. Source already matches what Renovate wrote in the lock files, so the recompile is a no-op for them; only actions-lock.json and the --pin get updated.
3. Commit pushed back to the renovate branch; check-gh-aw-lockfiles passes.