chore(deps): update autoscale docker tag to v5

[renovate]

This PR contains the following updates:

Package	Update	Change
autoscale	major	4.6.0 → 5.0.0

---

Release Notes

lunarys/generic-helm-chart (autoscale)

v5.0.0

Compare Source

Features

• security: stop mounting the API token into pods by default (7a32f1c)

BREAKING CHANGES

• security: pods no longer receive a ServiceAccount token unless
  serviceAccount.automountToken is set to true. Workloads using an
  in-cluster Kubernetes client, or sidecars injected by a mutating webhook
  that needs the token, must opt in.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Helm Template Diff

No rendered resource changes detected.

[lunarys]

Renovate Review: autoscale 4.6.0 → 5.0.0 (major, 02_bootstrap/03_traefik autoscale dependency)

Risk: 🟡 MEDIUM

Check	Result
Inputs	Complete — PR body has a real ### Release Notes section with an explicit ##### BREAKING CHANGES block; one matching diff comment present (slug __no_diff__, used because this change lives in 02_bootstrap/** rather than a per-app 03_apps/apps/** path).
Description vs. diff	Consistent — table says autoscale 4.6.0→5.0.0; the only file changed is 02_bootstrap/03_traefik/Chart.yaml, bumping the autoscale dependency version only (single line, condition: autoscale.enabled unchanged).
Rendered diff	Full, no truncation — empty (_No rendered resource changes detected._). Confirmed why: 02_bootstrap/03_traefik/values.yaml sets autoscale.enabled: false, and neither values-prod.yaml nor values-test.yaml overrides it, so the dependency is condition-disabled in every environment and renders nothing.
Changelog vs. config	No overlap today — the stated breaking change (pods no longer auto-mount a ServiceAccount token unless serviceAccount.automountToken: true) can't manifest because the subchart isn't installed anywhere; repo-wide search found no automountToken key set at all.

Details:

• Verified across all three value files for 02_bootstrap/03_traefik (values.yaml, values-prod.yaml, values-test.yaml): none sets autoscale.enabled: true, so this bump is currently inert at runtime.
• The diff-bot's __no_diff__ slug (rather than a named-app slug) is expected here since the change is under 02_bootstrap/, not 03_apps/apps/.

Worth noting (non-blocking):

• If autoscale.enabled is ever flipped to true later, the new default (no auto-mounted ServiceAccount token) will apply immediately since nothing here currently sets serviceAccount.automountToken. Worth a quick check at that point, not now.

Why MEDIUM: Major version bump with a stated breaking change, but confirmed contained blast radius — the affected subchart is condition-disabled in every environment, so current runtime impact is zero. Flagged Medium (not Low) per the major-bump criterion, since Low is reserved for patch/minor bumps.

---

Generated by Claude Code