chore(renovate): never digest-pin the SLSA generator; bump the Intel NEO stack as a set

[lusoris]

Summary

Two Renovate PRs in today's train could never merge, for reasons Renovate cannot know; this teaches it.

1. chore(deps): Pin slsa-framework/slsa-github-generator action to f7dd8c5 #1183 digest-pinned slsa-framework/slsa-github-generator. Its README: the generators "MUST be referenced by tag in order for the slsa-verifier to be able to verify the ref of the trusted builder" (hash-pinned reusable workflows unsupported, slsa-verifier#12). The Release Script Contract check enforces the tag form. → pinDigests: false for that package; tag bumps still flow.
2. chore(deps): Update dependency intel/gmmlib to v22.10.1 #1184 bumped intel/gmmlib alone. dev/Containerfile downloads libigdgmm12_${GMMLIB_VER} and the IGC debs from the compute-runtime release page for NEO_VER, so a lone bump 404s (curl: (22)), turning Dev Container Build red. → compute-runtime + intel-graphics-compiler + gmmlib + level-zero are one group. Manual review stays (ADR-0605).

Type

• build / ci — tooling / infra

Checklist

• Commits follow Conventional Commits.
• make format && make lint is green locally.
• Unit tests pass: meson test -C build.
• If I touched any SIMD/GPU code path, I ran /cross-backend-diff and the worst ULP is ≤ 2.
• If I touched a feature extractor with SIMD/GPU twins, I either updated every twin or listed the gap under "Known follow-ups" below.
• If I added a new .c / .cpp / .cu / .h / .hpp, it has the appropriate license header.
• If this is a breaking change, the commit message uses ! or BREAKING CHANGE: and the migration path is documented below.
• If this PR adds an ADR, the ADR row lives in docs/adr/_index_fragments/.

Config-only; no source, test, or compute path touched.

Bug-status hygiene (ADR-0165)

• docs/state.md updated in this PR with a row

no state delta: dependency-bot configuration only, no libvmaf bug opened or closed.

Netflix golden-data gate (ADR-0024)

• I did not modify any assertAlmostEqual(...) score in the Netflix golden Python tests.

Cross-backend numerical results

Not applicable.

Deep-dive deliverables (ADR-0108)

• Research digest — no digest needed: trivial.
• Decision matrix — no alternatives: only-one-way fix.
• AGENTS.md invariant note — no rebase-sensitive invariants.
• Reproducer / smoke-test command — pasted below under "Reproducer".
• CHANGELOG fragment — changelog.d/changed/renovate-train-hygiene.md.
• Rebase note — no rebase impact: renovate.json is fork-local.

Reproducer

python3 -c "import json;json.load(open('renovate.json'))"
bash scripts/release/tests/test-publication-environment-binding.sh   # untouched validator still PASSes on master's tag form

Known follow-ups

• A matched-set NEO/IGC/gmmlib/level-zero bump is being prepared separately; it supersedes chore(deps): Update dependency intel/gmmlib to v22.10.1 #1184.

Breaking changes / migration

None.

🤖 Generated with Claude Code