Track Renovate shared-workflows action metadata cleanup

## Context

Renovate cannot reliably update or validate Grafana repositories' pinned actions and reusable workflows from `grafana/shared-workflows`. The incident surfaced in the [docker-otel-lgtm dependency dashboard](https://github.com/grafana/docker-otel-lgtm/issues/920), where a shared-workflows digest lookup failed.

## Root causes

There are three related problems:

1. **Incomplete action tag comments.** Several consumers pinned a shared-workflows action SHA with a bare comment such as `# v0.2.2`. Shared-workflows is a monorepo, so the actual tag is component-prefixed (for example, `create-github-app-token/v0.2.2`). Historical tags use the hyphen form (for example, `get-vault-secrets-v1.2.0`), and those comments must match the tag that resolves to the pinned SHA. One `grafana-com` case was labeled `v1.3.0`, even though that tag never existed; its action content matched the genuine `send-slack-message/v2.0.4` tag, so the refs were corrected accordingly.
2. **The central Renovate preset is too broad.** Its `github-tags` override currently applies to every `grafana/shared-workflows` ref, including branch refs such as `main`; branch refs need the `github-digest` behavior instead. The preset must match only action-specific version-tag refs.
3. **Flint needs stable action metadata.** Renovate's existing dependency metadata cannot represent multiple action namespaces in one monorepo or distinguish version tags from branch refs. Flint therefore needs a separate `actionMeta` snapshot section and validation that catches missing component prefixes and tag-to-SHA mismatches, while preserving manager exclusions and treating transient GitHub failures as inconclusive.

The central preset, Flint validation, and consumer cleanup are all needed: the preset makes future lookups use the right datasource, Flint prevents malformed refs from entering the tree, and cleanup fixes the already-published malformed comments so existing dashboards and updates recover. None of these alone addresses the complete failure mode.

Flint's `renovate-tracked-deps` `actionMeta` validation is the general reusable prevention layer for repositories, not a one-off check for this rollout. Once [Flint PR #492](https://github.com/grafana/flint/pull/492) is released and adopted, any repository that runs Flint linting gains the protection through its existing tracked-dependencies check: Flint records action target/ref shape separately from ordinary dependency metadata, validates component namespaces and branch refs, and rejects deterministic tag-to-SHA or metadata mismatches before merge. Consumer repositories do not need bespoke validation logic; they receive the protection by using the normal Flint lint workflow and refreshing their snapshot when dependencies change.

## Related pull requests

All thirteen PRs in this rollout are now ready for review and are listed below.

- [grafana/grafana-renovate-config#116](https://github.com/grafana/grafana-renovate-config/pull/116) — narrow the shared-workflows datasource rule to version-tag refs (ready for review).
- [grafana/flint#492](https://github.com/grafana/flint/pull/492) — add `actionMeta` snapshot support and validation.
- [grafana/docker-otel-lgtm#1756](https://github.com/grafana/docker-otel-lgtm/pull/1756) — correct the token tag comment and remove the obsolete local rule.
- [grafana/shared-workflows#2254](https://github.com/grafana/shared-workflows/pull/2254) — clarify canonical slash tags and copyable SHA-pin examples.
- [grafana/grafana-opentelemetry-java#1397](https://github.com/grafana/grafana-opentelemetry-java/pull/1397) — correct propagated token tag comments.
- [grafana/grafana-opentelemetry-dotnet#669](https://github.com/grafana/grafana-opentelemetry-dotnet/pull/669) — correct propagated token tag comments.
- [grafana/federal-apps#230](https://github.com/grafana/federal-apps/pull/230) — correct propagated token tag comments.
- [grafana/grafana-usage-data-exporter#1232](https://github.com/grafana/grafana-usage-data-exporter/pull/1232) — correct propagated token tag comments.
- [grafana/field-eng-terraform-modules#486](https://github.com/grafana/field-eng-terraform-modules/pull/486) — correct the component-prefixed token tag comment.
- [grafana/grafana-cloud-migration-service](https://github.com/grafana/grafana-cloud-migration-service) — intended cleanup is ready locally but cannot be published (see below; no PR number exists).
- [grafana/helm-charts#4211](https://github.com/grafana/helm-charts/pull/4211) — correct historical get-vault-secrets tag comments.
- [grafana/mimir-prometheus#1282](https://github.com/grafana/mimir-prometheus/pull/1282) — correct historical send-slack-message tag comments.
- [grafana/grafana-com#20293](https://github.com/grafana/grafana-com/pull/20293) — replace the nonexistent v1.3.0 label with the genuine v2.0.4 tag and matching SHA.
- [grafana/grafana-com-clients#130](https://github.com/grafana/grafana-com-clients/pull/130) — correct the historical send-slack-message tag comment.

The cloud-migration-service change is commit `bb04689b` on `agent/cloud-migration-shared-workflows-tags`. Direct push was denied because the authenticated account has triage-only access, and GitHub has disabled forks for that repository (HTTP 403), so no PR number exists.

## Validation

The consumer PRs include workflow/config lint and relevant tests where available. The preset and Flint PRs contain their corresponding tests and snapshot changes. After these changes land, rerun self-hosted Renovate and confirm the dependency dashboard warnings clear.

Start by reviewing the linked Renovate preset and Flint PRs, then inspect the consumer workflow and configuration changes listed in the rollout. Check the corresponding tests and snapshots in those PRs. Done means the changes are reviewed and landed, self-hosted Renovate is rerun, and the dependency dashboard warnings clear.

Written by the indexing model from the issue text.