Justfile: match MintMaker's self-hosted settings in renovate target

- Allow the shell executor for post-upgrade commands so
  pipeline-migration-tool can expand $RENOVATE_POST_UPGRADE_COMMAND_DATA_FILE,
  and match MintMaker's execution timeout.
- Set ignorePrAuthor so on-demand runs see and update the bot's MRs.
- Disable the Dependency Dashboard for on-demand runs, since Renovate
  only finds dashboards created by the token's user and would otherwise
  create a duplicate.

Document the Commit Status: Create token permission (needed for branch
statuses) and MR ownership caveats in CONTRIBUTING.md.

Signed-off-by: John Eckersberg <dev@eckersberg.com>

CONTRIBUTING.md

@@ -72,6 +72,7 @@ Create a fine-grained personal access token: avatar → **Edit profile** →
 | Group and project | Project Planning | Work Item     | Read, Create, Update        |
 | Group and project | Project Planning | Label         | Read                        |
 | Group and project | CI/CD            | Pipeline      | Read                        |
+| Group and project | CI/CD            | Commit Status | Create                      |
 | User              | System Access    | User          | Read                        |
 | Global            | System Access    | Metadata      | Read                        |
 
@@ -91,4 +92,8 @@ just renovate --dry-run jeckersb/base-images  # run against a fork
 
 Commits and MRs will be authored by the token's user rather than the
 `konflux` bot. They use the same branches as the bot (`konflux/mintmaker/*`
-and `renovate/fedora-*/*`), so no duplicate MRs are created.
+and `renovate/fedora-*/*`), so no duplicate MRs are created. On-demand runs
+update the bot's existing MRs, but the bot only tracks MRs it created
+itself, so any new MR opened by an on-demand run stays yours until it is
+merged or closed. On-demand runs never create or update the Dependency
+Dashboard.

Justfile

@@ -107,7 +107,10 @@ renovate dry_run="" repo="fedora/bootc/base-images":
         -e RENOVATE_CONFIG_FILE=/config/global.json \
         -e RENOVATE_TOKEN -e RENOVATE_GITHUB_COM_TOKEN \
         -e LOG_LEVEL="${LOG_LEVEL:-info}" \
-        -e RENOVATE_FORCE='{"schedule":[],"updateNotScheduled":true}' \
+        -e RENOVATE_ALLOW_SHELL_EXECUTOR_FOR_POST_UPGRADE_COMMANDS=true \
+        -e RENOVATE_EXECUTION_TIMEOUT=40 \
+        -e RENOVATE_IGNORE_PR_AUTHOR=true \
+        -e RENOVATE_FORCE='{"schedule":[],"updateNotScheduled":true,"dependencyDashboard":false}' \
         {{renovate_image}} \
         renovate --platform=gitlab --endpoint=https://gitlab.com/api/v4 \
         {{if dry_run != "" { "--dry-run=full" } else { "" }}} {{repo}}