The role has been pulling from ghcr.io/matrix-org/matrix-hookshot, but the Renovate
depName still referenced the halfshot/matrix-hookshot Docker Hub repository, which
no longer receives release tags. As a result, Renovate never proposed 7.4.0/7.5.0.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

The ownership repair added in e5b8de8c2 is not sufficient on every Ansible privilege-escalation setup. Git may still see a different effective owner after the checkout has been recursively chowned, as demonstrated by #5065.

Pass an exact, task-scoped safe.directory setting to all 56 server-side git tasks. Keep the ownership repair as well, because it remains necessary for filesystem permissions. The two controller-side theme checkouts already use the same protection.

Document the multi-SFU publishing policy and re-enable the repaired image healthcheck. Verify trusted and remote grants and room creation against a real SFU.

Supersedes #5596.

Co-authored-by: mdad-renovate[bot] <322784800+mdad-renovate[bot]@users.noreply.github.com>

This change was made in order to use the MAS `account.password_registration_token_required` setting instead of the deprecated `account.registration_token_required` setting