feat(ci): Security hardening - SLSA Level 3 compliance and Renovate migration

[tkolleh]

Summary

This PR implements the security hardening plan to bring the CI/CD pipeline to SLSA Level 3 compliance and migrates from Dependabot to Renovate for dependency management.

Changes

Renovate Configuration (renovate.json - new)

• Created Renovate config with config:recommended and :dependencyDashboard presets
• Added github-actions manager with pinDigests: true for SHA pinning
• Added customManagers regex for lux.toml dependency detection using github-tags datasource (no native luarocks datasource exists in Renovate)
• Mapped busted → lunarmodules/busted, luacov → lunarmodules/luacov, luastatic → ers35/luastatic
• Excluded non-dependency fields (version, package, lua, license) from matching

Workflow Security Hardening

.github/workflows/tests.yml

• Pinned all action references to immutable SHA digests (SLSA Level 3)
• No permission changes (inherits repo default read)

.github/workflows/release-please.yml

• Pinned all 7 action references to immutable SHA digests
• Preserved paths-ignore configuration
• Added permissions block to build-release job only: contents: write, id-token: write, attestations: write
• Added SBOM generation via anchore/sbom-action@v0.17.0 (linux-x86_64 only)
• Added build provenance attestation via actions/attest-build-provenance@v1.4.3 (linux-x86_64 only)
• Added update-release-notes job that appends attestation verification instructions to releases
• SBOM uploaded only with linux-x86_64 artifacts (single SBOM, not per-platform)

.github/workflows/publish.yml

• Added environment: luarocks-publish for secret protection
• Pinned action references to immutable SHA digests
• Fixed indentation on rm -f "$ROCKSPEC" line
• No permission changes (inherits repo default read)

GitHub Environment

• Created luarocks-publish environment (via gh api)

Verification

All action SHAs have been verified against the GitHub API to match their claimed version tags:

Action	SHA	Version
actions/checkout	11bd71901bbe5b1630ceea73d27597364c9af683	v4.2.2 ✅
lumen-oss/gh-actions-lux	60bee431bba7e65b608b8aa309be0eb0252f5e79	v1.0.0 ✅
extractions/setup-just	dd310ad5a97d8e7b41793f8ef055398d51ad4de6	v2.0.0 ✅
googleapis/release-please-action	7987652d64b4581673a76e33ad5e98e3dd56832f	v4.1.3 ✅
msys2/setup-msys2	ddf331adaebd714795f1042345e6ca57bd66cea8	v2.24.1 ✅
anchore/sbom-action	d94f46e13c6c62f59525ac9a1e147a99dc0b9bf5	v0.17.0 ✅
actions/attest-build-provenance	1c608d11d69870c2092266b3f9a6f3abbf17002c	v1.4.3 ✅