fix(elixir): auto-merge lock file maintenance, and narrow its window

elixir.json

@@ -17,16 +17,22 @@
   "schedule": ["on sunday and monday"],
   "lockFileMaintenance": {
     "enabled": true,
-    "schedule": ["on sunday and monday"]
+    "schedule": ["before 5am on sunday"]
   },
   "packageRules": [
     {
       "description": "Intentional exception to the org-wide patch/digest-only auto-merge policy: Elixir (hex) packages are reliably semver-compliant, so minor and lockFileMaintenance updates are grouped and auto-merged as well. Which updates auto-merge is the exception; who merges them is not -- Renovate merges these, like every other auto-merged update, once it has seen all check runs go green. The required status check here is `ci / Code Quality` alone, so GitHub's auto-merge would release the merge while the OTP/Elixir test matrix is still running.",
       "matchManagers": ["mix"],
       "matchDatasources": ["hex"],
-      "matchUpdateTypes": ["minor", "patch", "digest", "lockFileMaintenance"],
+      "matchUpdateTypes": ["minor", "patch", "digest"],
       "groupName": "elixir dependencies",
       "automerge": true
+    },
+    {
+      "description": "Auto-merge lock file maintenance too. It cannot ride on the rule above: a lock file refresh carries no datasource, so matchDatasources there -- which is deliberate, keeping git dependencies out of the auto-merged lane -- excludes it. Naming lockFileMaintenance in that rule's matchUpdateTypes therefore did nothing, and the mix lock refreshes sat unmerged from 2026-08-30 while the npm ones, whose rule has no datasource filter, merged the same week.",
+      "matchManagers": ["mix"],
+      "matchUpdateTypes": ["lockFileMaintenance"],
+      "automerge": true
     }
   ]
 }