refactor(gitops): establish platform ownership boundaries

renovate.json

@@ -4,20 +4,55 @@
     "config:recommended"
   ],
   "enabledManagers": [
-    "argocd",
+    "custom.regex",
+    "kubernetes",
     "kustomize",
     "terraform",
     "terraform-version"
   ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": [
+        "/^platform/control-plane/argocd/application-sets/platform-addons\\.yaml$/"
+      ],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+) registryUrl=(?<registryUrl>\\S+)\\s+revision: (?<currentValue>\\S+)"
+      ]
+    },
+    {
+      "customType": "regex",
+      "datasourceTemplate": "docker",
+      "managerFilePatterns": [
+        "/^platform/control-plane/argocd/application-sets/platform-addons\\.yaml$/"
+      ],
+      "matchStrings": [
+        "# renovate: datasource=docker depName=(?<depName>\\S+)\\s+repository: \\S+\\s+tag: \"(?<currentValue>[^@\"]+)@(?<currentDigest>sha256:[a-f0-9]{64})\""
+      ]
+    }
+  ],
   "dependencyDashboard": true,
   "pinDigests": true,
   "packageRules": [
+    {
+      "description": "First-party GHCR images are promoted only by the verified digest workflow",
+      "matchDatasources": [
+        "docker"
+      ],
+      "matchPackageNames": [
+        "ghcr.io/donghyeonka/project-auth-server",
+        "ghcr.io/donghyeonka/project-api-server"
+      ],
+      "enabled": false
+    },
     {
       "description": "Require review for cluster controllers and stateful platform components",
       "matchFileNames": [
-        "clusters/dev-k3s/applications/foundation/**",
-        "clusters/dev-k3s/applications/platform/**",
+        "platform/control-plane/**",
+        "clusters/dev-k3s/overlays/platform/**",
+        "clusters/dev-k3s/overlays/systems/**",
         "platform/**",
+        "systems/**",
         "iac/**"
       ],
       "automerge": false