ci: least-privilege Pages token in e2e-kvm, pin actions to digests, hold the noble runner pins

.github/workflows/e2e-kvm.yml

@@ -1,9 +1,9 @@
 name: E2E (KVM)
 
+# Least privilege: the self-hosted e2e job only reads the repository. Only
+# deploy-pages gets the Pages token (#519).
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
   group: e2e-kvm-pages
@@ -92,6 +92,10 @@ jobs:
     if: ${{ success() && (github.event_name == 'workflow_dispatch' || github.event_name == 'schedule') }}
     needs: e2e
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

renovate.json

@@ -1,7 +1,8 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "local>tuna-os/.github"
+    "local>tuna-os/.github",
+    "helpers:pinGitHubActionDigests"
   ],
   "packageRules": [
     {
@@ -26,6 +27,22 @@
         "docs/experiments/evidence/**"
       ],
       "enabled": false
+    },
+    {
+      "description": "These workflows pin the ubuntu-24.04 runner on purpose: tests/e2e/package-runtime/host-data.py resolves the noble suites and pins noble qemu/ovmf packages, so a newer runner breaks the authenticated package closure (PR #491). Bump together with host-data.py, not alone.",
+      "matchDatasources": [
+        "github-runners"
+      ],
+      "matchPackageNames": [
+        "ubuntu"
+      ],
+      "matchFileNames": [
+        ".github/workflows/linux-package-execute.yml",
+        ".github/workflows/linux-package-runtime.yml",
+        ".github/workflows/offline-image-bundle.yml",
+        ".github/workflows/offline-release-plan.yml"
+      ],
+      "enabled": false
     }
   ]
 }