chore(deps): Update GitHub Actions to v2026-06-18

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
arillso/.github	action	patch	2026-06-14 → 2026-06-18

---

Release Notes

arillso/.github (arillso/.github)

v2026-06-18

Compare Source

Added

• workflows/README.md: Document ci-ansible-molecule.yml (usage, inputs,
  jobs, the driver: docker|qemu selector) — it was listed in the AGENTS.md
  CI table but missing from the workflow reference.

v2026-06-17

Compare Source

Added

• ci-ansible-molecule.yml: driver input (docker default, qemu) to
  pick the Molecule driver. qemu boots full VMs via the molecule-qemu
  driver for roles that need a real kernel and init system (k3s
  modprobe/cgroups, container engines, agents that must run as a stable
  systemd service — under docker the unit reports started while it has
  crash-looped, masking config bugs). GitHub-hosted ubuntu-latest exposes a
  writable /dev/kvm, so the job installs
  qemu-system-x86/qemu-utils/genisoimage, adds the runner to the kvm
  group, and runs molecule via sg kvm; molecule-qemu auto-detects KVM
  acceleration and falls back to TCG. Validated end-to-end on arillso.agent
  (alloy) and arillso.container (k3s).
• AGENTS.md: New "Ansible Collection Conventions" section documenting the
  shared release workflow shape (name, run-name, concurrency), the
  Keep-a-Changelog format, the cross-collection dependency-bound matrix
  (arillso.container → arillso.system >=0.0.17, arillso.agent →
  arillso.system >=0.0.36) plus min-version policy, and the common
  .python-version requirement
• templates/CHANGELOG.md: Keep-a-Changelog + SemVer template for bootstrapping
  collection changelogs
• renovate-ansible.json: Custom manager that keeps .python-version on a
  current released Python (python-version datasource, pep440 versioning)

Changed

• AGENTS.md: Correct the collection release workflow filename from
  release.yml to tag.yml (the event-focused template slot for tag pushes,
  alongside pull-request.yml / nightly-security.yml); the name: stays
  Release - Ansible Collection
• release-ansible-collection.yml: Read the publish Python version from the
  repo-root .python-version file when the python_version input is not set
  (input → .python-version → 3.11 fallback). The input default changed from
  3.11 to empty; callers that pass python_version are unaffected, callers
  that relied on the silent 3.11 default now get .python-version if present.
  Makes .python-version authoritative for releases.

---

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "before 6am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.