chore(ci): skip perf and commits gates on Renovate-authored PRs

The full CI pipeline (check, scan, commits, perf, a11y) was sized for
human PRs. On Renovate's dep-bump PRs:

- `perf` (Lighthouse build + 3-iteration median across the
  critical-routes list) costs 3-5 min per PR for a signal that is
  essentially zero on a patch/minor dep bump — the SPA today serves
  the static placeholder, and even with real routes the score on
  most bumps stays inside the median noise floor.
- `commits` re-validates messages that Renovate generates from a
  Conventional-Commits-conformant template. Tautological.

Skip both jobs when the PR author is the dedicated `apf-portal-bot`
Gitea user. The `push` event on `main` still runs the full pipeline,
so any regression a Renovate PR sneaks through is caught seconds
after merge — fast enough to revert without disruption.

ADR-0017 is amended to document the policy: the table of "where
Lighthouse CI runs" now distinguishes human PR / bot PR / push to
main; a new "Pre-merge gating policy" subsection records the
rationale and the human-takeover edge case. The §Confirmation
checklist is updated.

The docs/development.md "Reviewing Renovate PRs" subsection is
updated so contributors expect a leaner pipeline on bot PRs.

.gitea/workflows/ci.yml

@@ -79,7 +79,10 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   commits:
-    if: github.event_name == 'pull_request'
+    # PRs opened by Renovate (apf-portal-bot) carry commit messages
+    # generated from a vetted Conventional-Commits template — running
+    # commitlint on them is tautological. Per ADR-0017 amendment.
+    if: github.event_name == 'pull_request' && github.event.pull_request.user.login != 'apf-portal-bot'
     runs-on: [self-hosted, on-prem]
     steps:
       - uses: actions/checkout@v4
@@ -93,6 +96,13 @@ jobs:
       - run: COMMIT_LINT_FROM=origin/main pnpm ci:commits
 
   perf:
+    # Skip the Lighthouse run on PRs opened by Renovate (apf-portal-bot):
+    # the per-PR perf signal on a dep bump is essentially zero (no
+    # routes yet, bundle is the static placeholder), and the Lighthouse
+    # round-trip burns several minutes per PR. Push events on `main`
+    # still run perf — we catch regressions immediately post-merge,
+    # not pre-merge. Per ADR-0017 amendment.
+    if: github.event_name != 'pull_request' || github.event.pull_request.user.login != 'apf-portal-bot'
     runs-on: [self-hosted, on-prem]
     # Lighthouse CI drives a real Chrome instance; the default act runner
     # image (catthehacker/ubuntu:act-22.04) ships without one. The :full