alpine/k8s references are unreachable by every enabled Renovate manager #4010

docker.io/alpine/k8s appears eleven times across packages/ and hack/, and nothing updates any of them. Six carry a digest, five carry a bare tag.

enabledManagers in .github/renovate.json is gomod, dockerfile, github-actions, custom.regex. The helm-values and kubernetes managers are off, so the only thing that could reach these is a custom regex manager. There are two: one scoped to the single file packages/extra/etcd/templates/etcd-cluster.yaml, the other to ^packages/.+/templates/hooks/.+\.yaml$. None of the eleven match either one, and not one of them sits under templates/hooks/, so the manager written for exactly this kind of pin covers none of them.

• packages/core/installer/templates/cozy-system-labels.yaml:114
• hack/e2e-chainsaw/_lib/run-kubernetes.sh:510
• hack/e2e-cilium-leak-healer.yaml:94
• hack/e2e-install-cozystack.bats:163
• hack/e2e-talos-image-cache.yaml:81
• hack/e2e-talos-image-cache.yaml:107

A bump also has to touch hack/run-kubernetes-talos-diagnostics_test.bats:185-186, which asserts the same literal twice. That is what makes a hand refresh more expensive than it looks.

Five more references carry the same image on a bare 1.36.2 tag with no digest, which is a different failure from a stale pin but has the same cause: packages/apps/vm-disk/templates/pvc-resize-hook.yaml:39, packages/apps/vm-instance/templates/vm-update-hook.yaml:66, packages/system/cozystack-api/templates/hook.yaml:26, packages/system/seaweedfs/templates/hook.yaml:34, and packages/system/seaweedfs/values.yaml:87.

Three images/kubectl.tag files pin the same image at 1.33.4. Those are a different storage shape, handled by the image-reference tooling rather than by Renovate, so I have left them out of the count instead of assuming they share this gap.

It has aged once already. docs/changelogs/v1.6.0.md:530 records these references being refreshed by hand.