Same policy as adguard-cidre: patch-level Dockerfile bumps automerge,
minor/major get a labeled PR, vulnerability alerts labeled bug. No
pip_requirements rule — this repo has no Python dependencies to manage.
Still needed on the Gitea/Renovate side (manual, not done here):
uncomment socat-proxy in the shared ~/renovate/config.js repositories
array on stockeex, and create the bot/major/minor/bug labels in this
repo's Issues → Labels (Renovate silently drops labels that don't
already exist).
