Decide where Renovate updates the pinned end-to-end tools #870

The end-to-end tools are pinned by hand, and Renovate updates none of them. The Makefile's # renovate: comments match no manager: this repository's Renovate config extends only the shared preset, which defines no custom manager. A version that moves without its checksum still installs, but through go install: from source, and slowly. Each pin is in one of these places.

Options

Renovate can move a version and its checksum in one pull request: a custom regex manager with the github-release-attachments datasource finds the pinned file in the old release and returns its digest in the new one. The manager can live in one of two places.

Proposed scope

• Choose A or B, and add the custom manager there.
• Write each tool's version once, so that the Makefile and the Taskfile read the same pin.

Non-goals

• Other dependencies. Renovate updates them already.

Acceptance criteria

• This issue records the choice between A and B, and its reason.
• A new release of a pinned tool opens one Renovate pull request that moves its version and its checksum together.
• Each tool's version is written in one place.