ci: fix run #1880 — gitleaks false positives, gate docker/renovate on variables, e2e hard

- gitleaks flagged `STORAGE_KEY = 'cinny_recent_gifs_v1'` (a localStorage
  key name) as a generic API key. Allowlist namespaced cinny_/lotus- key
  names on *_KEY assignment lines, and skip dist/, node_modules/ and the
  vendored Element Call bundle (minified matrix-js-sdk crypto identifiers
  trip the same rule locally after a build). Verified: 0 findings on this
  tree with and without dist/ present.
- The runner has no `docker` binary and Gitea ignores job-level
  continue-on-error for the run conclusion, so the docker job painted the
  run red. It now runs only when the Actions variable CI_HAS_DOCKER is
  "true"; the weekly renovate job likewise only when RENOVATE_ENABLED is
  "true" (set alongside the RENOVATE_TOKEN secret).
- The Playwright e2e job passed on the runner, so it's a hard gate now.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

.gitleaks.toml

@@ -16,4 +16,21 @@ regexes = [
 paths = [
   '''config\.json''',
   '''\.npmrc''',
+  # Build output and vendored bundles are not source — CI scans a fresh
+  # checkout, but a local run after `npm run build` would trip on minified
+  # matrix-js-sdk crypto identifiers (claimedEd25519Key etc.).
+  '''^dist/''',
+  '''^node_modules/''',
+  '''^public/element-call/''',
+]
+
+# localStorage / IndexedDB key NAMES (e.g. `STORAGE_KEY = 'cinny_recent_gifs_v1'`)
+# match generic-api-key purely because the variable is called *_KEY. They are
+# namespaced identifiers, not credentials.
+[[rules]]
+id = "generic-api-key"
+[rules.allowlist]
+regexTarget = "line"
+regexes = [
+  '''(STORAGE|CACHE|IDB|DB|LS)_KEY\s*=\s*['"](cinny|lotus)[-_][a-z0-9_-]+['"]''',
 ]