fix: remove containers from workflow to fix Node.js compatibility

- Run directly on ubuntu-latest instead of custom containers
- Download git-cliff binary from GitHub releases
- Add Renovate custom manager for automatic git-cliff updates

CLAUDE.md

@@ -10,7 +10,8 @@ This repository contains reusable Gitea Actions workflows for Unbound Software r
 
 - **Location**: Workflows are stored in `.gitea/workflows/` (not `.github/workflows/`)
 - **Platform**: Gitea Actions (compatible with GitHub Actions syntax but runs on Gitea)
-- **Base images**: Uses pinned Alpine and git-cliff images with SHA256 digests for reproducibility
+- **Runner**: Uses `ubuntu-latest` runner directly (no containers)
+- **git-cliff**: Downloaded as binary from GitHub releases, version controlled via `GIT_CLIFF_VERSION` env var
 
 ### Release.yml Workflow
 
@@ -29,4 +30,3 @@ Version tracking uses a `.version` JSON file containing `{"version":"vX.Y.Z"}`.
 - No build/test commands exist - this is a workflow-only repository
 - Workflows use Gitea API directly via curl (not gh CLI)
 - Authentication reads from file-based token at `/runner-secrets/release-token`
-- Container images should include SHA256 digests for security