ci: Tidy CI pipeline for readability and performance

Pipeline Modernisation:
- Update prefligit to prek (same project, renamed to avoid
  typosquatting)
- Replace custom rust-toolchain action with direct uvx rustup
  invocation
- Remove dependency on install scripts in favour of uvx tool
  execution
- Make sccache conditional on GH_APP_ID and GH_APP_PRIVATE_KEY
  availability

Workflow Restructuring:
- Rename workflows for improved clarity:
  * rust-checks.yml → ci-checks.yml (consolidates Rust + prek)
  * element.yml → deploy-element.yml
  * documentation.yml → deploy-docs.yml
  * release-image.yml → release-builds.yml (Docker + binaries)
  * mirror-images.yml → docker-mirror.yml
- Delete obsolete prefligit-checks.yml (merged into ci-checks.yml)
- Combine format and prek checks into single fast-checks job

Cache Strategy Improvements (release-builds.yml):
- Add restore-keys to Rust registry and cargo target caches
- Include Cargo.toml files in cargo-target cache key
- Consolidate separate apt-cache and apt-lib steps into single step
- Version APT cache with Dockerfile hash instead of static keys
- Add platform-specific Docker buildcache tags
- Simplify Rust registry paths (remove checkouts/src subdirs)

CI Execution Improvements:
- Add uv cache for faster uvx tool invocations (prek, rustup)
- Enable concurrency control with cancel-in-progress
- Fix BOM handling in pre-commit

Dependency Management:
- Add renovate.yml workflow for scheduled dependency checking
- Configure renovate.json to monitor .forgejo/ and .github/ dirs
- Group non-major GitHub Actions updates into single PRs
- Set PR limits: 3 concurrent, 2 per hour

.forgejo/workflows/ci-checks.yml

@@ -0,0 +1,175 @@
+name: Checks / CI
+
+on:
+  push:
+  workflow_dispatch:
+
+# Cancel in-progress runs when a new push is made to the same branch
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  fast-checks:
+    name: Prek & Format
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: https://github.com/astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          ignore-nothing-to-cache: true
+          cache-dependency-glob: ''
+
+      - name: Run prek (formerly prefligit)
+        run: uvx prek run --show-diff-on-failure --color=always -v --all-files --hook-stage manual
+
+      - name: Install rust nightly with rustfmt
+        run: |
+          uvx rustup override set nightly
+          uvx rustup component add rustfmt
+
+      - name: Check formatting
+        run: |
+          cargo +nightly fmt --all -- --check
+
+  clippy:
+    name: Clippy
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: https://github.com/astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          ignore-nothing-to-cache: true
+          cache-dependency-glob: ''  # Disable Python dependency tracking for Rust project
+
+      - name: Install Rust toolchain
+        run: |
+          # Install toolchain from rust-toolchain.toml
+          uvx rustup show  # This will auto-install from rust-toolchain.toml
+
+      # cache-apt-pkgs-action requires apt lists to be initialised first
+      - name: Update APT package lists
+        run: sudo apt-get update
+
+      - name: Cache system packages
+        uses: https://github.com/awalsh128/cache-apt-pkgs-action@latest
+        with:
+          packages: clang liburing-dev
+          version: 1.0
+
+      - name: Cache Rust registry
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/git
+            !~/.cargo/git/checkouts
+            ~/.cargo/registry
+            !~/.cargo/registry/src
+          key: rust-registry-${{hashFiles('**/Cargo.lock') }}
+
+      - name: Run Clippy lints
+        run: |
+          cargo clippy \
+            --workspace \
+            --features full \
+            --locked \
+            --no-deps \
+            --profile test \
+            -- \
+            -D warnings
+
+  tests:
+    name: Tests
+    runs-on: ubuntu-latest
+    env:
+      SCCACHE_ENABLED: ${{ vars.GH_APP_ID != '' && secrets.GH_APP_PRIVATE_KEY != '' }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: https://github.com/astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          ignore-nothing-to-cache: true
+          cache-dependency-glob: ''  # Disable Python dependency tracking for Rust project
+
+      - name: Install Rust toolchain
+        run: |
+          # Install toolchain from rust-toolchain.toml
+          uvx rustup show  # This will auto-install from rust-toolchain.toml
+
+      # cache-apt-pkgs-action requires apt lists to be initialised first
+      - name: Update APT package lists
+        run: sudo apt-get update
+
+      - name: Cache system packages
+        uses: https://github.com/awalsh128/cache-apt-pkgs-action@latest
+        with:
+          packages: clang liburing-dev
+          version: 1.0
+
+      - name: Cache Rust registry
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/git
+            !~/.cargo/git/checkouts
+            ~/.cargo/registry
+            !~/.cargo/registry/src
+          key: rust-registry-${{hashFiles('**/Cargo.lock') }}
+
+      - name: Create GitHub App token for sccache
+        if: env.SCCACHE_ENABLED == 'true'
+        uses: https://github.com/actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ vars.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+          github-api-url: https://api.github.com
+          owner: ${{ vars.GH_APP_OWNER }}
+          repositories: ""
+
+      - name: Setup sccache
+        if: env.SCCACHE_ENABLED == 'true'
+        uses: ./.forgejo/actions/sccache
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+
+      - name: Setup Timelord
+        if: env.SCCACHE_ENABLED == 'true'
+        uses: ./.forgejo/actions/timelord
+        with:
+          key: sccache-v0
+          path: .
+
+      - name: Run Cargo tests
+        run: |
+          cargo test \
+            --workspace \
+            --features full \
+            --locked \
+            --profile test \
+            --all-targets \
+            --no-fail-fast
+
+      - name: Display sccache statistics
+        if: always() && env.SCCACHE_ENABLED == 'true'
+        run: sccache --show-stats