Hold Dockerfile majors, and document the Renovate setup in CLAUDE.md

[wormeyman]

Closes #45 and #46 - the two Renovate follow-ups that could be finished without waiting on anything external.

#45 - Dockerfile base images

src/WebApp/Dockerfile has two images that no rule covered, so Renovate's defaults were deciding for us:

• mcr.microsoft.com/dotnet/sdk:10.0 (line 1, build stage)
• mcr.microsoft.com/dotnet/runtime-deps:10.0-alpine (line 10, runtime stage)

Applies the precedent already set for Microsoft.ApplicationInsights.AspNetCore: majors off, patches on. WebApp is not deployed, so a .NET major here is not worth a review - but base images accumulate OS-level CVEs whether or not the service is hosted, and 10.0 / 10.0-alpine are floating tags whose digests move on their own. Keeping patch/minor live is what lets a rebuild pick those up. The two rules now cross-reference each other so they stay consistent.

Matched with matchManagers: ["dockerfile"] rather than a matchFileNames path. There is exactly one Dockerfile in the repo, confirmed from the job log:

Matched 1 file(s) for manager dockerfile: src/WebApp/Dockerfile

A path guess that silently stopped matching after a file move is exactly the failure the config warns about elsewhere.

One thing recorded in the comment rather than fixed: global.json now pins the SDK to 10.0.302, while this Dockerfile tracks whatever 10.0 resolves to. Those can drift apart silently, and Renovate will never flag it, because a floating tag is never "out of date". Worth knowing if the container build ever diverges from CI.

#46 - document it in CLAUDE.md

Verified by grep that CLAUDE.md and README mentioned Renovate exactly zero times, while eight packageRules were actively shaping what can be upgraded. Someone hitting a hold would experience it as the bot mysteriously not proposing an upgrade, with no pointer to the reasoning.

New "Dependency automation" section covering the weekly schedule, that nothing automerges and why, that holds exist and carry their reasons, that the dependency dashboard is the live inventory, and the tracking-issue convention.

The part most worth keeping is the silent failure mode: with "Require config file" enabled, an absent or unparseable config on the default branch makes Renovate do nothing at all, quietly - indistinguishable from "no updates available". Plus the two adjacent traps: only one config file may exist (a second is an error, not an override, and the validator cannot catch it), and narrowing matchers with a guess fails silently.

Verification

$ git show :.github/renovate.json5 > /tmp/renovate.json5
$ npx --yes --package renovate -- renovate-config-validator /tmp/renovate.json5
 INFO: Config validated successfully

Validated against the staged blob rather than the working tree. Also confirmed no em/en dashes in either file, per the repo convention.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DN9nGF1Q8fvbZv1W74JkJ6