feat: renovate watches the 32 chart pins it could not see

[stxkxs]

Adopting the shared Renovate preset gave this repo a renovate.json that covered none of its actual version surface.

Every chart version here is pinned inside an install.sh, because explicit install scripts are the point (CLAUDE.md: don't add helm wrappers or "easier" automation). Renovate ships no manager that reads a version out of a shell script.

What was unwatched

32 chart pins, zero visible to Renovate. mirror-check.py catches part of it by comparing kx against eks-gitops, but it skips anything declared kx-only in stack/upstream.json. That leaves seven charts with no currency instrument at all:

argo-cd · cloudnative-pg · ingress-nginx · kube-prometheus-stack · minio · nats · trust-manager

argo-cd sits on chart 9.5.14 against 10.2.3 — a full chart major, 22 releases — and nothing anywhere would have said so.

The fix moves no pins

Two customManagers: one for helm repo add + alias/chart, one for charts pulled straight from OCI (which have no repo line). The registry URL and the chart are captured separately without a backreference, which works because each install.sh adds exactly one repo — Renovate's engine is RE2 and has no backreferences.

The gate, because the config alone proves nothing

A customManager whose regex matches nothing is valid config that watches nothing. renovate-config-validator passes it — the schema is fine and the pattern is never run against a file. That is the same defect this PR is fixing, one level up.

So scripts/check-renovate-coverage.py reads the matchStrings out of renovate.json — the shipped ones, not a copy — applies them to the tree, and fails on any pin left unmatched. Edit the regex and break coverage, and CI says so.

It also rejects lookaround and backreferences, which are legal in Python's re and absent from RE2: a pattern using one would pass a local check and match nothing in production. Relatedly it translates (?<name>) → (?P<name>) to run RE2 syntax under Python, and does so only after rejecting the lookbehind forms — otherwise the translation turns (?<= into a group named =. That ordering is commented at the line.

Verification

Proven red before being trusted:

injected fault	result
an addon whose shape no matchString covers	FAIL, naming the file
customManagers deleted outright	FAIL
a matchString containing a lookahead	FAIL, naming RE2
the tree as it stands	OK — 32 pins, all matched

shellcheck and yamllint both clean. The new job is in the merge gate's needs, so it is blocking.

Expect a kx-stack-charts PR from Renovate on the next run — that backlog is the point, and argo-cd 9.5.14 → 10.2.3 wants reading before it lands.