## Renovate automerge enabled with base-image update exclusions

**Component:** olm-operator-konflux-sample

Renovate automerge is enabled broadly rather than scoped to low-risk update types, while the catalog base image (`ose-operator-registry`) is excluded from tracking entirely, creating an inconsistent update posture.

### Remediation
Scope automerge to low-risk update types only (e.g. `packageRules` with `matchUpdateTypes: ["digest"]`) or set `automerge: false` and document required-review branch protection; remove the `ose-operator-registry` ignore so the catalog base is tracked.

---
*Source: Ex-Wing/Glasswing Konflux CI security assessment (Mythos), finding FIND-005*