fix: on a Renovate branch, .aqua/aqua.yaml is Renovate's

[closer-claudio]

🎯 Why

The v0.10.0 converge seeds golang/go into .aqua/aqua.yaml (#323), the one file Renovate manages on its branch. Renovate renders it on every run, so the converge's line was removed, added back, removed: forkcloser/curl#50 was force-pushed seventeen times in twenty minutes with a checksum-workflow run after each, and every bump of the wave was starting the same loop. The v0.9.0 converges only wrote .limen/* and the checksums, which Renovate leaves alone.

🛠️ What

• internal/rules/fix.go: FixOptions.RenovateBranch; when set, remediateAqua leaves an existing .aqua/aqua.yaml as Renovate rendered it (outcome none, saying so) and skips the aqua rule's residual advisory for it, so the rest of the converge still commits. The check in CI names what the manifest lacks ("missing canonical package(s): golang/go"), which is main's to gain by a limen fix there.
• internal/cli/cli.go: the flag comes from GITHUB_REF_NAME starting with renovate/, the runner's variable, so no workflow change is needed and the branch's own pinned limen does the right thing from v0.10.1 on.
• .github/workflows/update-aqua-checksum.yaml: the converge step's comment says so (content-pinned, comment only).
• book/tooling.md: the first seed is made on main by the owner, never on a Renovate branch, with the loop as the reason.

Telling a seeded bump from a looping one: a repository whose main already carries the pin was never touched by the converge there, under v0.10.0 as well (missingCanonicalPkgs is empty), so its converge commit has no .aqua/aqua.yaml in it and the branch settles in two runs; a looping one shows the file in every converge commit and a new head every minute.

🧪 How

• V: TestAquaRenovateBranchLeavesManifest: a manifest without the pin, fix with RenovateBranch: file byte-identical, outcome none naming Renovate, no aqua advisory, and limen check still fails naming golang/go.
• V: just lint and just test green locally.
• U: the live loop ending on a v0.10.1 bump branch; the fleet seed on each main ends it for v0.10.0's.

📝

Rides v0.10.1.

[closer-claudio]

✅ at 98ac927: the converge stops touching the one file Renovate renders, the check still says what main lacks, and the loop has no second actor left.

• 🔍 Checked: remediateAqua now has three cases in the order that matters, no manifest (seed), Renovate's branch (leave it, outcome none naming Renovate), otherwise merge; the residual aqua advisory is skipped only in the Renovate case, so a broken manifest on main is still reported; check is untouched and names golang/go as missing, which the test asserts together with the byte-identical file and the absence of an advisory. The flag reads GITHUB_REF_NAME, which the runner sets to the branch on the push the checksum workflow runs on, and renovate/ is the prefix every Renovate branch in the fleet carries; a human's limen fix on such a branch, without the variable, merges as before, which is right. The workflow change is comment-only in a content-pinned file, so it ships with the release and reaches repositories through their bumps; the book names the seed as main's, by the owner, with curl#50's seventeen pushes as the reason.
• 🔍 The diagnosis matches what I measured on curl#50 (a converge commit with .aqua/aqua.yaml in it, a new head every ~65 s, the App's run after each) and the v0.9.0 converges that never touched the file. On a v0.10.0 branch the fix cannot help, since the branch's pinned limen is the one that loops; the seed on each main ends those, and from v0.10.1 the converge is harmless on an unseeded repository too, with a red limen lane saying why. One signed commit on current main; ci green at this head.