fix(renovate): let the molecule manager pin a digest

[sbaerlocher]

Summary

• The Molecule platform images customManager in renovate-ansible.json gains an autoReplaceStringTemplate, so the pinDigests rule beside it can actually pin. Without it Renovate's field-wise rewrite path only changes tokens the matched line already holds — pinning a bare :latest leaves currentValue unchanged and has no currentDigest to swap, so the line came back byte-identical, confirmIfDepUpdated found no digest, and the branch was discarded with Error updating branch: update failure.
• The template reproduces the whole match (image: prefix and trailing newline included) because replaceAt swaps the match as a unit; matchStrings is unchanged. The digest slot is guarded by {{#if newDigest}} so a plain tag update does not emit a bare @.
• A new renovate-molecule-manager CI job runs scripts/tests/test-renovate-molecule-manager.sh, which reads regex and template out of the JSON with jq and asserts a round trip: the unpinned line matches, the rendered template matches that same regex again, and the digest comes back out of it — the exact re-extraction that fails today.
• Known ceiling: the template writes the value unquoted with a single space after image:, so a quoted value would lose its quotes. Still valid YAML, and no molecule scenario in the consuming repositories uses that form.

Test plan

• scripts/tests/test-renovate-molecule-manager.sh — was red before the preset change (the molecule customManager has no autoReplaceStringTemplate) and passes with it
• jq empty renovate-ansible.json, yamllint .github/workflows/pull-request.yml, shellcheck and shfmt -d on the new script
• The neighbouring guards test-renovate-rst-manager.sh and test-workflow-input-injection.sh still pass
• CI green
• Not coverable in CI: the actual rewrite shows only on the next Renovate run against a consumer repository, and consumers extend a dated preset tag — final verification is the follow-up run on arillso/ansible.agent once the tag moves, not this merge