Pin Testcontainers to 1.x and skip rebuilds for config-only commits

Testcontainers 2.0 renamed the postgresql/junit-jupiter module artifacts, so the major
bump can't even be resolved — disable it rather than let a bot PR reopen it each run.

.gitea/workflows/build.yml

@@ -2,6 +2,9 @@ name: build-and-publish
 on:
   push:
     branches: [main]
+    # Files that can't change the image. Skipping them avoids a pointless rebuild that Watchtower
+    # would then redeploy — a few seconds of downtime on a live site for a docs-only commit.
+    paths-ignore: ["renovate.json", "**.md"]
   # Lets `rebuild-all-apps.sh` force a rebuild (e.g. to roll out an urgent platform fix immediately
   # instead of waiting for a Renovate bump PR).
   workflow_dispatch:

renovate.json

@@ -7,6 +7,12 @@
       "matchPackageNames": ["net.thebennett.platform:**"],
       "groupName": "bennett platform",
       "automerge": true
+    },
+    {
+      "description": "Stay on Testcontainers 1.x. 2.0 renamed the module artifacts (postgresql, junit-jupiter), so the major bump doesn't just fail the build — its POM won't even parse. Revisit deliberately, not via a bot PR.",
+      "matchPackageNames": ["org.testcontainers:**"],
+      "matchUpdateTypes": ["major"],
+      "enabled": false
     }
   ],
   "vulnerabilityAlerts": {