Upstream Renovate releases several times a day, which produced about
45 runner bump commits per month. Staying on the very latest version
brings little benefit, so these updates now happen once a month.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Update ghcr.io/element-hq/synapse Docker tag to v1.161.0

Update ghcr.io/matrix-org/matrix-hookshot Docker tag to v7.5.0

The role has been pulling from ghcr.io/matrix-org/matrix-hookshot, but the Renovate
depName still referenced the halfshot/matrix-hookshot Docker Hub repository, which
no longer receives release tags. As a result, Renovate never proposed 7.4.0/7.5.0.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Update pre-commit hook ansible/ansible-lint to v26.9.0

The ownership repair added in e5b8de8c2 is not sufficient on every Ansible privilege-escalation setup. Git may still see a different effective owner after the checkout has been recursively chowned, as demonstrated by #5065.

Pass an exact, task-scoped safe.directory setting to all 56 server-side git tasks. Keep the ownership repair as well, because it remains necessary for filesystem permissions. The two controller-side theme checkouts already use the same protection.