ci: fix run #1880 — gitleaks false positives, gate docker/renovate on variables, e2e hard

- gitleaks flagged `STORAGE_KEY = 'cinny_recent_gifs_v1'` (a localStorage
  key name) as a generic API key. Allowlist namespaced cinny_/lotus- key
  names on *_KEY assignment lines, and skip dist/, node_modules/ and the
  vendored Element Call bundle (minified matrix-js-sdk crypto identifiers
  trip the same rule locally after a build). Verified: 0 findings on this
  tree with and without dist/ present.
- The runner has no `docker` binary and Gitea ignores job-level
  continue-on-error for the run conclusion, so the docker job painted the
  run red. It now runs only when the Actions variable CI_HAS_DOCKER is
  "true"; the weekly renovate job likewise only when RENOVATE_ENABLED is
  "true" (set alongside the RENOVATE_TOKEN secret).
- The Playwright e2e job passed on the runner, so it's a hard gate now.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

.gitea/workflows/renovate.yml

@@ -17,7 +17,12 @@ jobs:
   renovate:
     name: Renovate
     runs-on: ubuntu-latest
-    continue-on-error: true # informational until RENOVATE_TOKEN is confirmed present
+    # Gated on the Actions VARIABLE `RENOVATE_ENABLED` == "true" (set it together
+    # with the RENOVATE_TOKEN secret). Gitea ignores job-level continue-on-error
+    # for the run conclusion, so without the gate every weekly run would be red
+    # until the token exists. Also needs a Docker-capable runner (uses the
+    # renovate/renovate image) — see CI_HAS_DOCKER in ci.yml.
+    if: ${{ vars.RENOVATE_ENABLED == 'true' }}
     steps:
       - name: Run Renovate
         uses: docker://renovate/renovate:44