Move check/renovate onto brick-build, deploy stays brick-host

Renovate no longer needs Docker access for a one-shot docker-run job:
switched to setup-node + npm install -g renovate (matching labelprint's
workflow), so it fits the same brick-build runner as check instead of
the stale "deploy" label. Also note down the build-log readability/API
gaps flagged from a real failed terrain build.

.gitea/workflows/ci.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   check:
-    runs-on: ubuntu-latest
+    runs-on: brick-build
     steps:
       - uses: actions/checkout@v4
 

.gitea/workflows/renovate.yml

@@ -8,17 +8,22 @@ on:
 
 jobs:
   renovate:
-    # The native deploy runner (see docs/deployment.adoc) already has
-    # Docker access — Renovate itself is a one-shot batch job, not a
-    # long-running service, so `docker run`, not docker-compose.
-    runs-on: deploy
+    runs-on: brick-build
     steps:
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Install Renovate
+        run: npm install -g renovate
+
       - name: Run Renovate
-        run: |
-          docker run --rm \
-            -e RENOVATE_PLATFORM=gitea \
-            -e RENOVATE_ENDPOINT="${{ gitea.server_url }}/api/v1/" \
-            -e RENOVATE_TOKEN="${{ secrets.RENOVATE_TOKEN }}" \
-            -e RENOVATE_REPOSITORIES="${{ gitea.repository }}" \
-            -e RENOVATE_ONBOARDING=false \
-            renovate/renovate
+        run: renovate
+        env:
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_ENDPOINT: "${{ gitea.server_url }}/api/v1/"
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_REPOSITORIES: "${{ gitea.repository }}"
+          RENOVATE_ONBOARDING: "false"
+          GITHUB_COM_TOKEN: ${{ secrets.GITHUB_COM_TOKEN }}