[Feature]: Renovate version radar + backend version support window

Read IC-ADR-002 §§6 and 8, then inspect renovate.json, stacks.yml, and the existing matrix workflow. Verify how backend ARGs and version axes are currently represented. Done means the Renovate bump, version matrix, scheduled canary, and deduplicated failure issue meet every checked item in the Definition of Done.

User Story

As an interCEde maintainer,
I want every backend version pinned and tracked by Renovate, plus a weekly unpinned canary,
So that an upstream release that breaks a contract (e.g. HTCondor 25.8's one-shot spool retrieval)
surfaces as a red, bisectable Renovate PR instead of tribal knowledge.

Feature Description

IC-ADR-002 §6 + §8:

• Lane 1 (blocking): enable docker-compose + dockerfile Renovate managers; customManagers
  regex for # renovate:-annotated ARGs (ARC/Slurm/HTCondor-CE versions). Backend bumps grouped
  per backend, never mixed. A bump PR triggers image rebuild + full matrix.
• Version support window: each backend declares oldest/LTS anchor + leading edge as a
  versions: matrix axis in stacks.yml (start: HTCondor [lts, latest], ARC/Slurm leading-edge
  only; ARC floor = 7.x). Renovate tracks only the leading edge; anchors accept patch bumps only;
  moving the window is a deliberate human PR.
• Lane 2 (non-blocking canary): weekly scheduled run of the same matrix against latest/nightly
  tags; failures open a deduplicated issue.

Definition of Done

• renovate.json extended: compose + dockerfile managers, ARG regex, per-backend grouping
• A test bump PR shows: image rebuild + integration matrix run + red/green verdict
• versions: axis consumed by the matrix; HTCondor runs lts + latest
• Weekly canary workflow exists, non-blocking, deduplicated issue on failure
• PR latency flat: PRs run leading edge (+1 anchor); full cross-product on schedule only

Alternatives Considered

• Unpinned tracking only (canary as the mechanism of record) — green-today-red-tomorrow with no
  diff to bisect; rejected (ADR Rejected Ideas).
• Testing only the newest daemon — answers the wrong question; sites run LTS/old versions (§8).

Related Issues

Additional Context