Renovate no longer needs Docker access for a one-shot docker-run job: switched to setup-node + npm install -g renovate (matching labelprint's workflow), so it fits the same brick-build runner as check instead of the stale "deploy" label. Also note down the build-log readability/API gaps flagged from a real failed terrain build.