Support atomic BuildStream source version and checksum updates in Renovate

[castrojo]

Problem

The repository's generic Renovate regex manager can change a BuildStream source version while leaving the source ref unchanged. For example, changing nginx_version, tmux_version, or qemu_version changes the tarball URL but leaves its SHA-256 ref for the prior tarball, so the resulting dependency-update PR cannot fetch sources reproducibly.

The manager is being removed rather than emitting unsafe PRs. This also affects other regex-managed BuildStream sources whose URL or track and pinned ref must agree.

Evidence

• Renovate's github-releases datasource explicitly says its digest is the release tag's underlying Git SHA and that it does not know which release artifact a manager uses: https://github.com/renovatebot/renovate/blob/main/lib/modules/datasource/github-releases/index.ts#L38-L46.
• NGINX publishes a detached .asc signature but no .sha256 sidecar for nginx-1.27.5.tar.gz.
• tmux's 3.7b GitHub release publishes only tmux-3.7b.tar.gz.
• QEMU publishes a detached .sig but no .sha256 sidecar for qemu-8.2.2.tar.xz.

Required shared capability

Provide a supported Renovate/shared-infrastructure manager or datasource for BuildStream archive and remote sources that:

1. identifies the exact release artifact used by the element;
2. obtains an authoritative artifact SHA-256 from an upstream checksum manifest or a verified upstream signature, and fails closed when neither is available;
3. replaces the version/URL or track and the BuildStream ref in one atomic update; and
4. has extraction/update tests proving a PR cannot change a source location without its matching checksum or commit ref.

Do not re-enable regex annotations for BuildStream sources until this capability exists and has been accepted by maintainers.

Acceptance criteria

A Renovate update for each supported BuildStream source changes the source selector and its corresponding pinned ref together, with the hash traceable to an authoritative upstream artifact-verification mechanism. Sources without that mechanism remain unautomated.