ci: pin perf-runner image by tag and stop automerging it (#1562)

<!-- entire-trail-link-start -->
https://entire.io/gh/jdx/usage/trails/100
<!-- entire-trail-link-end -->

Renovate's runs on this repo report `Package lookup failures` for the
perf-runner image (`Could not determine new digest for update`). The
perf workflows pin the image by digest only, so Renovate looks for the
`latest` tag, which `jdx/perf-runner` never publishes (it only pushes
`jdx-perf-v1`), and gets a 404.

The pin now names the published tag as well:

```yaml
image: ghcr.io/jdx/perf-runner:jdx-perf-v1@sha256:5263c143…
```

The digest is unchanged, so the image the perf jobs run does not change.
Renovate can now follow the `jdx-perf-v1` tag and open a PR when the
image is rebuilt.

The shared preset automerges digest updates, so this also adds a package
rule that turns automerge off for `ghcr.io/jdx/perf-runner`. A rebuilt
image changes the toolchain every perf baseline is measured on, and that
should go through the perf check, not merge on its own.

The `image:` strings that the workflows echo into the report are left as
they were.

*AI-assisted — Tool: Claude Code; model: Anthropic/claude-sonnet-5-5;
version: unavailable.*

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> CI and Renovate config only; the container digest is unchanged so
runtime perf behavior is unaffected.
> 
> **Overview**
> Fixes Renovate **package lookup failures** for the perf CI container
by pinning `ghcr.io/jdx/perf-runner` with the published **`jdx-perf-v1`
tag** alongside the existing digest in `perf.yml` and `perf-pr.yml`. The
digest is unchanged, so perf jobs still run the same image; Renovate can
now track tag updates instead of failing on a missing `latest` tag.
> 
> Adds a **Renovate `packageRules` entry** that disables **automerge**
for `ghcr.io/jdx/perf-runner`, so image/toolchain bumps require human
review and the perf gate rather than merging automatically via the
shared preset.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
a720c21. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated the performance-testing workflows to use a version-tagged
runner image while retaining the existing image digest.
* Changes to the performance runner image will no longer be merged
automatically.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

Author: jdx

.github/renovate.json

@@ -1,4 +1,11 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["github>jdx/renovate-config"]
+  "extends": ["github>jdx/renovate-config"],
+  "packageRules": [
+    {
+      "description": "The perf-runner image sets the toolchain every perf baseline is measured on; review bumps instead of automerging them.",
+      "matchPackageNames": ["ghcr.io/jdx/perf-runner"],
+      "automerge": false
+    }
+  ]
 }

.github/workflows/perf-pr.yml

@@ -84,7 +84,7 @@ jobs:
     # the report would say "nothing was compared" instead of anything useful.
     runs-on: [self-hosted, jdx-perf-v1]
     container:
-      image: ghcr.io/jdx/perf-runner@sha256:5263c143b12ce2234e7b0b21d3d6501c2ed05837b42937d0eaeaa191cd5c8e68
+      image: ghcr.io/jdx/perf-runner:jdx-perf-v1@sha256:5263c143b12ce2234e7b0b21d3d6501c2ed05837b42937d0eaeaa191cd5c8e68
       options: --cpuset-cpus 0-7
     timeout-minutes: 40
     permissions:

.github/workflows/perf.yml

@@ -38,7 +38,7 @@ jobs:
     # that wanders between runners is unreadable.
     runs-on: [self-hosted, jdx-perf-v1]
     container:
-      image: ghcr.io/jdx/perf-runner@sha256:5263c143b12ce2234e7b0b21d3d6501c2ed05837b42937d0eaeaa191cd5c8e68
+      image: ghcr.io/jdx/perf-runner:jdx-perf-v1@sha256:5263c143b12ce2234e7b0b21d3d6501c2ed05837b42937d0eaeaa191cd5c8e68
       options: --cpuset-cpus 0-7
     timeout-minutes: 30
     permissions: