chore(ci): skip perf and commits gates on Renovate-authored PRs (#23)

## Summary
Renovate's dep-bump PRs run the full pipeline today (`check`, `scan`, `commits`, `perf`, `a11y`). Two of those gates have near-zero signal on a typical bump and dominate the wall-clock cost:

- **`perf`** — Lighthouse build + 3-iteration median across the critical-routes list. 3-5 min per PR for a metric that is essentially zero on a patch/minor dep bump (the SPA today serves the static placeholder; even with real routes a typical bump stays inside the median noise floor).
- **`commits`** — re-validates commit messages that Renovate generates from a Conventional-Commits-conformant template. Tautological.

Skip both when the PR author is the `apf-portal-bot` Gitea user. The `push` event on `main` still runs the full pipeline post-merge, so any regression caught by `perf` is detected seconds after merge — fast enough to revert.

Net result: Renovate PRs run `check + scan + a11y` only, ≈ 4-5 min faster per PR.

## ADR amendment

ADR-0017 is amended in the same change:
- "Where Lighthouse CI runs" table now distinguishes human PR / bot PR / push to main / scheduled / local.
- New "Pre-merge gating policy: human PRs vs bot PRs" subsection records the rationale and the human-takeover edge case.
- §Confirmation entry for `perf` is reworded to reflect the conditional gate.

## Test plan
- [ ] After merge, the next Renovate-triggered PR (auto-rebase or new bump) shows only `check`, `scan`, `a11y` queued — no `perf`, no `commits`.
- [ ] A human-opened PR (e.g. this one) still queues all 5 gates.
- [ ] On `push` to `main` post-merge, the full pipeline runs including `perf`.

---------

Co-authored-by: Julien Gautier <julien.gautier@apf.asso.fr>
Reviewed-on: #23

.gitea/workflows/ci.yml

@@ -79,7 +79,10 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   commits:
-    if: github.event_name == 'pull_request'
+    # PRs opened by Renovate (apf-portal-bot) carry commit messages
+    # generated from a vetted Conventional-Commits template — running
+    # commitlint on them is tautological. Per ADR-0017 amendment.
+    if: github.event_name == 'pull_request' && github.event.pull_request.user.login != 'apf-portal-bot'
     runs-on: [self-hosted, on-prem]
     steps:
       - uses: actions/checkout@v4
@@ -93,6 +96,13 @@ jobs:
       - run: COMMIT_LINT_FROM=origin/main pnpm ci:commits
 
   perf:
+    # Skip the Lighthouse run on PRs opened by Renovate (apf-portal-bot):
+    # the per-PR perf signal on a dep bump is essentially zero (no
+    # routes yet, bundle is the static placeholder), and the Lighthouse
+    # round-trip burns several minutes per PR. Push events on `main`
+    # still run perf — we catch regressions immediately post-merge,
+    # not pre-merge. Per ADR-0017 amendment.
+    if: github.event_name != 'pull_request' || github.event.pull_request.user.login != 'apf-portal-bot'
     runs-on: [self-hosted, on-prem]
     # Lighthouse CI drives a real Chrome instance; the default act runner
     # image (catthehacker/ubuntu:act-22.04) ships without one. The :full