[cgwalters-bot]

The devspace runner is moving to hosting cgwalters-bot agent sessions, so it should come up with the bot's environment rather than the human's.

• just init now clones cgwalters-bot/homegit to $HOME/src/github/cgwalters-bot/homegit (same toplevel/origin safety checks as before), checks out a pinned commit (homegit_rev in the Justfile, currently 7f322ad47024), fetching it into an existing checkout if needed, and runs make install. Runners execute homegit code, so it's pinned and bumps come as reviewed Renovate PRs via the shared git-refs Justfile manager. Interactive users on the runner get the bot's git identity from its .gitconfig.
• The Actions runner has umask 000 and homegit's rsync doesn't preserve permissions, so the recipe sets umask 022 and drops group/world write from what it installed and from the top-level dotfiles in $HOME (the runner image ships ~/.bash_profile and ~/.bash_logout as 666).
• opencode and Claude Code are installed globally with npm from RHEL 10's Node.js 22, at exact versions pinned in npm.txt: opencode-ai@1.18.31 (newest release older than three days) and @anthropic-ai/claude-code@2.1.267 (the stable dist-tag). The file uses the same annotated format as bootc-dev/infra's devenv/npm.txt.
• The new renovate.json extends the shared bootc-dev config and adds a three-day minimumReleaseAge for npm. This enables Renovate repo-wide, so Cargo dependencies and pinned actions get update PRs too, assuming the Renovate app is enabled here.

Tested locally: cargo fmt --check, clippy with -D warnings, cargo test (15 pass, and each commit passes on its own), and actionlint. just init was run under umask 000 in a throwaway HOME against the real fork: a fresh clone, a checkout left at an older commit, and one missing the pinned commit all end up on the pinned rev with nothing world-writable, and a mismatched origin is refused. The workflow step was run verbatim in a UBI 10 container with a runner user. The shared Renovate regexes matched npm.txt (including the scoped package) and the Justfile.

Out of scope: agent credentials and inference via praxis. Relates to #4 (and cgwalters-bot/praxis-credential-broker#1).

This PR is AI-generated at the human's request and has not yet been reviewed by the human; please review it as such before merging.

Tested on a real runner

Dispatched this branch at 9a151ca (run 35808095996, 4 cores): every setup step succeeded, and over SSH as runner:

• homegit is at the pinned 7f322ad47024a7b003c31c5ec662106a8b5e08fc;
• ~/.bashrc, ~/.bash_profile, ~/.bash_logout and ~/.gitconfig are 644, ~/.config and ~/.local/bin are 755, and find ~ -perm -o+w finds nothing (an earlier run without the top-level fix still had the image's .bash_profile/.bash_logout at 666);
• bash -lc true prints nothing (no tput noise);
• opencode --version → 1.18.31, claude --version → 2.1.267 (Claude Code), both from /usr/local/bin on the SSH login PATH.

An earlier run (35805439383, pin 6021d58) also confirmed the bot's git identity and the skills under ~/.claude/skills.

Generated-by: https://github.com/cgwalters/#llms