Pin platform 0.1.0 release and wire up automatic propagation

- parent/BOM now point at the immutable 0.1.0 release instead of a SNAPSHOT
- declare the Gitea Maven registry so Renovate can discover new platform versions
- renovate.json: group platform bumps into one automerged PR
- CI: drop --no-cache (releases are immutable, so caching is safe again) and add
  workflow_dispatch so rebuild-all-apps.sh can force an urgent rebuild

renovate.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "packageRules": [
+    {
+      "description": "Bennett platform releases: our own code, already tested and Trivy-scanned before publish. Group the parent + BOM + starters into one PR and merge it automatically so security fixes reach this app without manual work. Merging main triggers the build, which re-runs tests and re-scans; if either fails no image is pushed, so a bad bump can't reach production.",
+      "matchPackageNames": ["net.thebennett.platform:**"],
+      "groupName": "bennett platform",
+      "automerge": true
+    }
+  ],
+  "vulnerabilityAlerts": {
+    "labels": ["security"]
+  }
+}