fix(ci): keep the publisher contract pin in dependency updates #103

Problem

The dependency update in #101 changes the immutable release-plz action reference in the release workflow.
The release contract test still expects the previous action reference and rejects the updated workflow.
The quality job fails two workflow contract tests with immutable publisher action.
The Rust declaration is outside the existing Renovate managers.

Intended behavior

Keep the workflow and its expected publisher reference on the same reviewed immutable commit.
Track the existing Rust declaration with a manager limited to its file and declaration.
Group that declaration with the same action's workflow declarations in one dependency update.
Keep the executable version, candidate identity, complete qualification, source guards, and derived configuration checks strict.

Scope

Change xtask/tests/ci_workflow.rs and renovate.json to repair the publisher binding.
Keep the existing action updates from #101 in .github/workflows/ci.yml, .github/workflows/mutants-full.yml, and .github/workflows/release-plz.yml.
Use the immutable action reference already selected in #101.
Keep codec behavior, fixtures, selected executable versions, workflow triggers, credentials, and publication controls unchanged.

Acceptance

The affected workflow contract tests accept the exact reviewed action reference.
They reject another commit, a moving tag, and altered publisher settings or source guards.
Dependency extraction finds the action version and digest in the Rust declaration without capturing unrelated text.
An update to release-plz/action keeps its workflow and Rust references in the same branch.
The grouping rule matches only that dependency in the GitHub Actions and custom regular expression managers.
Other dependencies, schedules, and release age rules keep their existing behavior.
The supported Renovate validator accepts the configuration.
Test this binding through the workflow contracts and dependency extraction.

Evidence

The failing quality job reports the two contract failures.
The selected action metadata supports the existing explicit executable version input.
The Renovate regular expression manager supports named version and digest captures for untracked declarations.
Renovate puts updates with the same group name in one branch.