Stop Renovate holding docker image updates on a check that can never pass

[AAraKKe]

What does this PR do?

• Scopes minimumReleaseAgeBehaviour: "timestamp-optional" to the docker-images Renovate group.
• Enables the dependency dashboard.

Motivation

The 7-day minimumReleaseAge on the docker-images group can never be satisfied. Renovate's docker datasource only reads release timestamps from Docker Hub, and the two images tracked in .gitlab/tagger/Dockerfile come from ghcr.io (renovate#39064) and registry.ddbuild.io. Since Renovate 42, minimumReleaseAgeBehaviour defaults to timestamp-required, so a release with no timestamp is treated as not yet aged, and renovate/stability-days stays pending indefinitely rather than for 7 days. #24835 is an example.

timestamp-optional rather than dropping minimumReleaseAge, so the age check still applies if an image from a registry that does publish timestamps is added to the group later.

The dependency dashboard makes updates held back by the age check visible. Without it there is no way to tell "held back" from "nothing to update" short of reading the job log.

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Add qa/required if this PR needs QA validation, or qa/skip-qa if it does not. Exactly one of the two is required.
• If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

[dd-octo-sts]

Validation Report

All 21 validations passed.

Show details

Validation	Description	Status
agent-reqs	Verify check versions match the Agent requirements file	✅
ci	Validate CI configuration and code coverage settings	✅
codeowners	Validate every integration has a CODEOWNERS entry	✅
config	Validate default configuration files against spec.yaml	✅
dep	Verify dependency pins are consistent and Agent-compatible	✅
http	Validate integrations use the HTTP wrapper correctly	✅
imports	Validate check imports do not use deprecated modules	✅
integration-style	Validate check code style conventions	✅
jmx-metrics	Validate JMX metrics definition files and config	✅
labeler	Validate PR labeler config matches integration directories	✅
legacy-signature	Validate no integration uses the legacy Agent check signature	✅
license-headers	Validate Python files have proper license headers	✅
licenses	Validate third-party license attribution list	✅
metadata	Validate metadata.csv metric definitions	✅
models	Validate configuration data models match spec.yaml	✅
openmetrics	Validate OpenMetrics integrations disable the metric limit	✅
package	Validate Python package metadata and naming	✅
qa-label	Validate the pull request declares whether it needs QA for the next Agent release	✅
readmes	Validate README files have required sections	✅
saved-views	Validate saved view JSON file structure and fields	✅
version	Validate version consistency between package and changelog	✅

View full run

[cit-pr-commenter-54b7da]

evalya-impact-summary

evalya impact analysis

Impact analysis: RUN-ALL — every test task will run
Trigger:         empty diff (default branch, scheduled run, or shallow-clone fallback)
Test tasks:      0 (all selected)
Publish tasks:   1 (always emitted)
Diff:            empty (no diff information)

Learn more about CI impact filtering