[Feature]: Renovate version radar + backend version support window

## User Story

As an interCEde maintainer,
I want every backend version pinned and tracked by Renovate, plus a weekly unpinned canary,
So that an upstream release that breaks a contract (e.g. HTCondor 25.8's one-shot spool retrieval)
surfaces as a red, bisectable Renovate PR instead of tribal knowledge.

## Feature Description

IC-ADR-002 §6 + §8:

- **Lane 1 (blocking):** enable `docker-compose` + `dockerfile` Renovate managers; `customManagers`
regex for `# renovate:`-annotated `ARG`s (ARC/Slurm/HTCondor-CE versions). Backend bumps grouped
per backend, never mixed. A bump PR triggers image rebuild + full matrix.
- **Version support window:** each backend declares *oldest/LTS anchor* + *leading edge* as a
`versions:` matrix axis in `stacks.yml` (start: HTCondor `[lts, latest]`, ARC/Slurm leading-edge
only; ARC floor = 7.x). Renovate tracks only the leading edge; anchors accept patch bumps only;
moving the window is a deliberate human PR.
- **Lane 2 (non-blocking canary):** weekly scheduled run of the same matrix against latest/nightly
tags; failures open a deduplicated issue.

## Definition of Done

- [ ] `renovate.json` extended: compose + dockerfile managers, ARG regex, per-backend grouping
- [ ] A test bump PR shows: image rebuild + integration matrix run + red/green verdict
- [ ] `versions:` axis consumed by the matrix; HTCondor runs `lts` + `latest`
- [ ] Weekly canary workflow exists, non-blocking, deduplicated issue on failure
- [ ] PR latency flat: PRs run leading edge (+1 anchor); full cross-product on schedule only

## Alternatives Considered

- Unpinned tracking only (canary as the mechanism of record) — green-today-red-tomorrow with no
diff to bisect; rejected (ADR Rejected Ideas).
- Testing only the newest daemon — answers the wrong question; sites run LTS/old versions (§8).

## Related Issues

## Additional Context

Read IC-ADR-002 §§6 and 8, then inspect renovate.json, stacks.yml, and the existing matrix workflow. Verify how backend ARGs and version axes are currently represented. Done means the Renovate bump, version matrix, scheduled canary, and deduplicated failure issue meet every checked item in the Definition of Done.

Written by the indexing model from the issue text.