[Bug]: Allow verified Renovate pull requests through the queue identity audit

[ben-ranford]

Problem

Renovate PR #1658 cannot enter the queue because commit 80002c2 is rejected as bot-authored. The commit is authored by renovate[bot] and signed through GitHub web-flow.

Scope and acceptance criteria

• Accept authenticated Renovate PRs with verified Renovate-authored commits, including GitHub web-flow signed commits.
• Preserve the canonical user identity audit for human commits and reject untrusted bots, spoofed or missing identities, and invalid signatures.
• Audit every PR-unique commit; preserve current-base checks, head-race checks, repository requirements, and queue ordering.
• Cover the live failure with a regression and adversarial controller tests.
• Document the narrow exception and stale Renovate branch handling.

Scope firewall: review items belong here only when they directly prevent these acceptance criteria and are incremental corrections in the queue controller and focused tests. Other automation changes remain separate.