[Dependency/Sync] Stop consumer Renovate from editing Workflows-owned files

[stranske]

Why

renovate-presets/fleet.json:4-35 applies the shared preset to Workflows and every consumer but contains no boundary for overwrite-managed consumer paths. The manifest currently declares .github/workflows/agents-guard.yml and .github/workflows/maint-76-claude-code-review.yml as centrally copied files (.github/sync-manifest.yml:109-126), yet consumer Renovate opened PRs that changed only those paths (for example Inv-Man-Intake#838 and Manager-Database#1347); those PRs were later closed unmerged. This is a current productivity break: the dependency bot independently edits files that Maint 68 will replace from Workflows.

Scope

• Derive the consumer-side Renovate exclusion rule from overwrite-managed entries in .github/sync-manifest.yml.
• Keep Renovate enabled for canonical Workflows source files and for consumer-owned/create-only workflow files.
• Publish the generated rule as a reusable preset consumed by renovate-presets/fleet.json.
• Add a contract test that fails when a new overwrite-managed path is visible to consumer Renovate.

Non-Goals

• Do not blanket-ignore .github/workflows/**; ci.yml, autofix.yml, and create-only/bootstrap surfaces can be repo-owned.
• Do not disable Renovate in Workflows or for runtime dependency files.
• Do not change Maint 68 copy semantics or consumer exceptions in this issue.
• Scaffold-only completion does NOT count: adding an unused preset or a test fixture that is not derived from the live manifest fails this issue.

Tasks

• Add scripts/generate_consumer_renovate_ownership.py to compile overwrite-managed target paths and registered consumer repositories from .github/sync-manifest.yml plus scripts/list_registered_consumer_repos.py.
• Generate renovate-presets/consumer-managed-paths.json with a package rule that disables dependency extraction only when both the repository and manifest-managed target match.
• Extend renovate-presets/fleet.json to consume the generated ownership preset while leaving the Workflows repository outside the consumer-only match.
• Add tests/scripts/test_generate_consumer_renovate_ownership.py covering exact-file, directory, skip_repos, overwrite_repos, and sync_mode: create_only behavior.
• Extend tests/workflows/test_dependency_bot_conditions.py so agents-guard.yml and maint-76-claude-code-review.yml are excluded in consumers while ci.yml and autofix.yml remain eligible.
• Update docs/ops/CONSUMER_REPO_MAINTENANCE.md and docs/ci/TOOL_VERSION_MANAGEMENT.md with the Renovate-versus-Maint-68 ownership contract and regeneration command.
• Wire the generator into scripts/dev_check.sh so a stale generated preset fails local and CI validation.

Acceptance Criteria

• python -m pytest tests/scripts/test_generate_consumer_renovate_ownership.py tests/workflows/test_dependency_bot_conditions.py -q passes and reads the real .github/sync-manifest.yml.
• The generated preset disables Renovate for the manifest targets agents-guard.yml and maint-76-claude-code-review.yml in registered consumers, but not for those source files in stranske/Workflows.
• The same test proves consumer-owned ci.yml and autofix.yml remain visible to Renovate.
• python scripts/generate_consumer_renovate_ownership.py --check exits zero on the committed preset and non-zero after any managed-path drift.
• Deliberate-break gate: temporarily remove the agents-guard.yml manifest entry or alter its generated rule; tests/scripts/test_generate_consumer_renovate_ownership.py::test_manifest_managed_workflows_are_disabled_for_consumers must fail. Restore the manifest/preset before requesting review.

Implementation Notes

• Current baseline: main@5084eb7d55047491e71745a2a534a8530893bff6.
• Relevant files: .github/sync-manifest.yml, renovate-presets/fleet.json, renovate.json, scripts/sync_manifest_compiler.py, scripts/list_registered_consumer_repos.py, scripts/dev_check.sh, tests/workflows/test_dependency_bot_conditions.py, tests/workflows/test_sync_manifest_delivery.py, and docs/ops/CONSUMER_REPO_MAINTENANCE.md.
• Preserve the distinction between overwrite-managed, create-only, skipped, and runtime-fetched entries.
• Validate the generated JSON with the Renovate schema/config validator in addition to pytest.

[stranske]

Closer sequencing — keep open until durable verifier PASS

PR #2892 merged at 2026-08-02T08:30:38Z (2700e40f) and now has verify:compare. GitHub auto-closed this issue on merge; reopening per closer policy so the issue stays open until a durable verifier/provider-comparison PASS (or dispositioned non-PASS) lands on #2892.

Next: wait for verifier comment on #2892, then close this issue if PASS with no remaining disposition debt.

[stranske]

Closing after merged PR #2892 received a durable Provider Comparison PASS/PASS report at 2026-08-02T08:44Z, with zero unresolved non-outdated review threads. The closer hold has been satisfied.