chore: keep cmd/dockerflagsgen tidy with the root module

[nozaq]

Problem

The dockerflags job is red on main, and therefore on every PR branched
from it (including #164, whose own diff only touches an action SHA):

go -C cmd/dockerflagsgen test ./...
go: updates to go.mod needed; to update it:
	go mod tidy
make: *** [Makefile:53: dockerflags-test] Error 1

cmd/dockerflagsgen replaces github.com/bare-devcontainer/decolint with a
local path, so the root module's requirements are part of its build list.
#163 bumped golang.org/x/sys to v0.48.0 in the root go.mod while
cmd/dockerflagsgen/go.mod still required v0.47.0, and go test refuses to
run against a stale go.mod.

Changes

• go mod tidy in cmd/dockerflagsgen — golang.org/x/sys v0.47.0 → v0.48.0
  in go.mod and go.sum.
• Renovate postUpdateOptions: gomodTidy → gomodTidyAll. gomodTidy only
  tidies the module Renovate updated, which is why cmd/dockerflagsgen kept
  being left behind. gomodTidyAll additionally runs go mod tidy on every
  module that depends on the updated one through a local replace directive,
  and covers the updated module itself — so a future root bump lands in the
  same PR as the matching cmd/dockerflagsgen update.

Source: postUpdateOptions in the Renovate configuration reference;
gomodTidyAll is in the renovate-schema.json this config already
$schema-references. It must not be combined with gomodMassage, which this
config does not use.

Verification

• make dockerflags-test — passes
• make dockerflags + git diff --exit-code dockerargs/runflags.go — no diff
• make test — passes
• make lint — 0 issues
• renovate-config-validator — config validated successfully

No Go source changed, so coverage is unaffected.

🤖 Generated with Claude Code

---

Generated by Claude Code