[Feature]: Renovate version radar + backend version support window #15

User Story

As an interCEde maintainer,
I want every backend version pinned and tracked by Renovate, plus a weekly unpinned canary,
So that an upstream release that breaks a contract (e.g. HTCondor 25.8's one-shot spool retrieval)
surfaces as a red, bisectable Renovate PR instead of tribal knowledge.

Feature Description

IC-ADR-002 §6 + §8:

• Lane 1 (blocking): enable docker-compose + dockerfile Renovate managers; customManagers
  regex for # renovate:-annotated ARGs (ARC/Slurm/HTCondor-CE versions). Backend bumps grouped
  per backend, never mixed. A bump PR triggers image rebuild + full matrix.
• Version support window: each backend declares oldest/LTS anchor + leading edge as a
  versions: matrix axis in stacks.yml (start: HTCondor [lts, latest], ARC/Slurm leading-edge
  only; ARC floor = 7.x). Renovate tracks only the leading edge; anchors accept patch bumps only;
  moving the window is a deliberate human PR.
• Lane 2 (non-blocking canary): weekly scheduled run of the same matrix against latest/nightly
  tags; failures open a deduplicated issue.

Definition of Done

• renovate.json extended: compose + dockerfile managers, ARG regex, per-backend grouping
• A test bump PR shows: image rebuild + integration matrix run + red/green verdict
• versions: axis consumed by the matrix; HTCondor runs lts + latest
• Weekly canary workflow exists, non-blocking, deduplicated issue on failure
• PR latency flat: PRs run leading edge (+1 anchor); full cross-product on schedule only

Alternatives Considered

• Unpinned tracking only (canary as the mechanism of record) — green-today-red-tomorrow with no
  diff to bisect; rejected (ADR Rejected Ideas).
• Testing only the newest daemon — answers the wrong question; sites run LTS/old versions (§8).

Related Issues

Additional Context