The release.yml workflow uses https://gitea.com/actions/release-action@main.
Renovate's gitea-tags manager tries to resolve @main as a tag and 404s,
which crashes the entire renovate run (affecting all repos via autodiscover).
Repo-level ignoreDeps + a packageRule make this defense-in-depth alongside
the global ignoreDeps in /opt/renovate/config.js.