chore(sync): synced file(s) with cplieger/ci

cliff.toml

@@ -107,7 +107,11 @@ exclude_paths = [
   ".github/",                  # CI workflows + pins: never in the artifact
   "**/*.md",                   # docs, incl. fix:-typed README-only edits
   "LICENSE",
-  "alerts.yaml",               # README-companion alert rules (docs artifact)
+  "alerts/",                   # README-companion alert rules, one file per
+                               # expression language (a ruler parses every expr in
+                               # the file it loads, and PromQL/LogQL are mutually
+                               # unparseable, so a mixed single file loads in neither)
+  "alerts.yaml",               # the pre-folder root form, until no repo has one left
   "compose.yaml",              # the root-level example compose
   "tests/",                    # smoke tests: exercised at build, never shipped
   "**/testdata/",

scripts/repin-sha.sh

@@ -1,4 +1,9 @@
 #!/bin/sh
+# Renovate sha256 repin helper — CANONICAL COPY in cplieger/ci
+# (configs/repin-sha.sh), synced to scripts/repin-sha.sh in every repo with a
+# root Dockerfile by scripts/classify-repos.py. DO NOT edit the synced copy in
+# an app repo — change it here and let the sync land it.
+#
 # Recompute a Dockerfile sha256 integrity pin after Renovate moved its version
 # literal. Run by Renovate itself via postUpgradeTasks, because no datasource
 # publishes a sha256, so the recomputed pin lands in the bump commit.