Add Renovate custom manager to track Fedora base image in execution-environment.yml

Renovate is already configured in this repo but only tracks Python packages. The Fedora base image in execution-environment.yml is not covered, which has caused it to go stale twice (#660, #774) — leaving the project on an EOL Fedora version for weeks before someone notices.

Renovate approach (won't work)

A Renovate customManagers regex entry with the docker datasource can detect new tags on quay.io/fedora/fedora-minimal, but it cannot distinguish stable releases from development/rawhide images. Fedora publishes container tags for unreleased versions (e.g., :45 is currently tagged but its org.opencontainers.image.version OCI label is rawhide, not 45). Renovate does not inspect OCI image labels for version filtering — it only uses them for sourceUrl and gitRef. This means Renovate would propose premature bumps to unstable releases.

See closed PR #777 for the attempted Renovate approach.

Alternative under investigation

A custom GitHub Actions workflow that uses skopeo inspect to check the org.opencontainers.image.version OCI label on the next tag. Only when the label matches the tag number (i.e., it's a stable release, not rawhide) would it open a PR. This avoids third-party dependencies and uses the registry as the source of truth.

Follow-up to #774.

Start by reviewing execution-environment.yml and the closed PR #777, then inspect the repository's existing Renovate and GitHub Actions configuration. The workflow should use skopeo to check the Fedora image's OCI version label and open an update only when it matches a stable tag, avoiding rawhide releases.