ci(renovate): silence github.com rate limit + skip internal workflow ref

Wire an optional read-only GITHUB_COM_TOKEN so Renovate can reach
api.github.com (changelogs + actions/checkout-style updates) without
rate limiting, and disable management of the internal Gitea reusable
workflow `played/workflows` (it's a @main ref, not a github.com action).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/renovate.yml

@@ -47,12 +47,17 @@ jobs:
           # Reuse the build-time npmrc so Renovate can resolve @played/* from
           # the Gitea registry.
           RENOVATE_NPMRC: ${{ secrets.NPMRC }}
+          # Read-only github.com PAT (no scopes needed for public data). Avoids
+          # api.github.com rate limits and enables changelogs + updates for the
+          # real github.com actions used in deploy.yml (actions/checkout, etc.).
+          GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}
           LOG_LEVEL: ${{ inputs.logLevel || 'info' }}
           RENOVATE_DRY_RUN: ${{ inputs.dryRun && 'full' || '' }}
         run: |
           docker run --rm \
             -e RENOVATE_TOKEN \
             -e RENOVATE_NPMRC \
+            -e GITHUB_COM_TOKEN \
             -e LOG_LEVEL \
             -e RENOVATE_DRY_RUN \
             -e RENOVATE_PLATFORM=gitea \