ci: Tidy CI pipeline for readability and performance

Pipeline Modernisation:
- Update prefligit to prek (same project, renamed to avoid
  typosquatting)
- Replace custom rust-toolchain action with direct uvx rustup
  invocation
- Remove dependency on install scripts in favour of uvx tool
  execution
- Make sccache conditional on GH_APP_ID and GH_APP_PRIVATE_KEY
  availability

Workflow Restructuring:
- Rename workflows for improved clarity:
  * rust-checks.yml → ci-checks.yml (consolidates Rust + prek)
  * element.yml → deploy-element.yml
  * documentation.yml → deploy-docs.yml
  * release-image.yml → release-builds.yml (Docker + binaries)
  * mirror-images.yml → docker-mirror.yml
- Delete obsolete prefligit-checks.yml (merged into ci-checks.yml)
- Combine format and prek checks into single fast-checks job

Cache Strategy Improvements (release-builds.yml):
- Add restore-keys to Rust registry and cargo target caches
- Include Cargo.toml files in cargo-target cache key
- Consolidate separate apt-cache and apt-lib steps into single step
- Version APT cache with Dockerfile hash instead of static keys
- Add platform-specific Docker buildcache tags
- Simplify Rust registry paths (remove checkouts/src subdirs)

CI Execution Improvements:
- Add uv cache for faster uvx tool invocations (prek, rustup)
- Enable concurrency control with cancel-in-progress
- Fix BOM handling in pre-commit

Dependency Management:
- Add renovate.yml workflow for scheduled dependency checking
- Configure renovate.json to monitor .forgejo/ and .github/ dirs
- Group non-major GitHub Actions updates into single PRs
- Set PR limits: 3 concurrent, 2 per hour

.forgejo/workflows/renovate.yml

@@ -0,0 +1,60 @@
+name: Maintenance / Renovate
+on:
+  schedule:
+    # Run at 2am UTC daily
+    - cron: '0 2 * * *'
+  workflow_dispatch:
+    inputs:
+      dryRun:
+        description: 'Dry run mode'
+        required: false
+        default: 'false'
+        type: choice
+        options:
+          - 'true'
+          - 'false'
+      logLevel:
+        description: 'Log level'
+        required: false
+        default: 'info'
+        type: choice
+        options:
+          - 'debug'
+          - 'info'
+          - 'warn'
+          - 'error'
+  push:
+    branches:
+      - main
+    paths:
+      - '.forgejo/workflows/renovate.yml'
+      - 'renovate.json'
+
+jobs:
+  renovate:
+    name: Renovate
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run Renovate
+        uses: renovatebot/github-action@v40.1.0
+        with:
+          token: ${{ secrets.RENOVATE_TOKEN }}
+          configurationFile: renovate.json
+        env:
+          # Platform settings
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_ENDPOINT: ${{ github.server_url }}/api/v1
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+
+          # Repository settings
+          RENOVATE_REPOSITORIES: '["${{ github.repository }}"]'
+
+          # Behaviour settings
+          RENOVATE_DRY_RUN: ${{ inputs.dryRun || 'false' }}
+          LOG_LEVEL: ${{ inputs.logLevel || 'info' }}
+
+          # Forgejo/Gitea specific
+          RENOVATE_GIT_AUTHOR: '${{ vars.RENOVATE_AUTHOR }}'