Pin renovate to python 3.14.*

.github/workflows/lint-policy-in-other-repos.yml

@@ -37,7 +37,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v7
         with:
-          python-version: "3.15"
+          python-version: "3.14"
       - name: Install dependencies
         working-directory: cfengine-cli
         run: |

.github/workflows/update-syntax-description.yml

@@ -28,7 +28,7 @@ jobs:
       - name: Set up Python 3.12
         uses: actions/setup-python@v7
         with:
-          python-version: "3.15"
+          python-version: "3.14"
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip

renovate.json5

@@ -74,10 +74,12 @@
 
     // The python version is also pinned in the make-check matrix and in the
     // classifiers, which Renovate cannot reach. One PR, not three.
+    // Capped at 3.14 because that is what users run; raise deliberately.
     {
       matchDepNames: ["python"],
       groupName: "python-version",
       groupSlug: "python-version",
+      allowedVersions: "<3.15",
     },
 
     // Support floor, not a dependency. "bump" would raise it to ">=3.14.7"