feat(renovate): auto-bump DefaultPostgresImage digest within postgres:18 (RIG-2774)

[rigel-mintaka]

This PR is part of a stack containing 2 PRs:

1. main
2. "feat(renovate): auto-bump DefaultPostgresImage digest within postgres:18 (RIG-2774)" (this PR)
3. fix(renovate): mirror flake.nix Go vendorHash + cap wails/v3 below 3.1 (RIG-2852) #681

Surface go/internal/stack/postgres_image.go's DefaultPostgresImage Go const
as a docker dep via a custom.regex manager in tools/renovate/config.json5 so
upstream postgres:18 security rebuilds (same major, new digest) flow through a
reviewable PR instead of the pin silently rotting.

DL-260 freezes the postgres MAJOR at 18 for on-disk-format stability, so a
paired packageRule pins allowedVersions to /^18$/: the digest moves, an 18->19
major bump stays a deliberate design action (re-run the T8 podman integration
test), never an auto-PR.

Two conventions the file's shape forces:

• depName is 'postgres-stack', NOT 'postgres': the CI-service disable fence
  (matchDepNames ['postgres'], enabled false) is unscoped by manager/file, so a
  'postgres' depName would inherit the disable and open zero PRs. The distinct
  name keeps the two postgres pins independently governed; a last-match-wins
  replay test asserts postgres-stack resolves ENABLED while 'postgres' stays
  disabled.
• versioningTemplate is explicit 'docker': a custom.regex manager defaults to
  semver-coerced regardless of datasource, which mishandles a @
  reference.

The repo-wide 5-day minimumReleaseAge soak is kept: Docker Hub carries a
tag_last_pushed timestamp for the digest, so a rebuild clears the window (no
permanent-pending stall the git-refs channel dep needs nulled).

config.test.ts gains a RIG-2774 block: manager shape, live regex extraction
against the real Go file, the digest-only /^18$/ rule, and the fence-
independence behavioral guard. Updates the const's bump-procedure comment to
describe the automated digest path.

Spec-impact: none

---

Review disposition (sole review of record, 2 rounds)

• Round 1 — 0 high / 0 medium / 2 low. Both lows (test-teeth) FIXED: regex-extraction now matchAll + toHaveLength(1) (matches the file's catalog/devenv convention); digest-only rule gains a semantic allowedVersions check (accepts 18, rejects 19). Red-green verified both guards fail closed.
• Round 2 (on the fixed diff) — 0 high / 0 medium / 1 low. Clean at the high+medium floor; both round-1 fixes confirmed correct with real teeth. The 1 low (DRY the two last-match-wins replay helpers in config.test.ts) is a maintainability judgment call touching pre-existing test infra — DEFERRED to keep this PR single-purpose, filed as RIG-2838.

Local validation: moon run renovate:ci 89 pass / 0 fail, typecheck clean, biome clean. Pre-push whole-repo moon ci passed on submit.

[linear-code]

RIG-2774

[github-actions]

Compass engineering docs preview: https://dependencies-rig-2774-postgr.compass-eng-docs.pages.dev

Deployed from dependencies/rig-2774-postgres-digest at 34f7911.