Epic: GHA migration follow-up from skopeo-sandbox review

Summary

Tracking epic for unresolved CI review feedback from the podman-container-tools/skopeo-sandbox Cirrus → GHA migration.

The sandbox work landed upstream in PR #2883. These items are follow-up from sandbox PR https://github.com/podman-container-tools/skopeo-sandbox/pull/1 / PR https://github.com/podman-container-tools/skopeo-sandbox/pull/9 review threads and the upstream audit before deprecating the sandbox repo.

Sub-issues

• #2912 — migrate renovate.json5 to podman-container-tools/automation
• #2913 — add zizmor workflow for GitHub Actions security scanning
• #2914 — remove leftover Cirrus config after GHA migration
• #2915 — remove git safe.directory workaround from container jobs
• #2916 — golangci-lint installed via make tools instead of golangci-lint-action
• #2917 — ostree_rs_ext job uses archived ostree-rs-ext repository
• #2918 — cancel-in-progress cancels overlapping CI runs on main pushes
• #2922 — doccheck does build + install before validate-docs
• #2923 — redundant make vendor in test_skopeo job
• #2924 — ostree_rs_ext reinstalls Rust and rebuilds dependencies every run

Related (not sub-issues)

• PR #2911 — Renovate-managed AUTOMATION_RELEASE in ci.yml (companion to #2912)
• Draft PR #2885 — started safe.directory / Makefile GOBIN cleanup (companion to #2915)
• #2633 — broader CI Switch: Cirrus → TMT umbrella
• Draft PR #2640 — TMT work including ostree-rs-ext (related to #2917)

Background

• Sandbox: https://github.com/podman-container-tools/skopeo-sandbox
• Upstream migration: PR #2883