chore(deps): update dependency mikefarah/yq to v4.53.3

Merge the separate actions/checkout packageRule into the existing
ah-annotations rule to reduce duplication. Update README examples to use
current versions (actions/checkout@v5.0.0, ah-annotations@v0.0.1).

Co-authored-by: Copilot <copilot@github.com>

README.md

@@ -14,10 +14,10 @@ Without explicit inputs the action determines the two most recent non-RC tags fr
 
 ```yaml
 steps:
-  - uses: actions/checkout@v4
+  - uses: actions/checkout@v7.0.1
     with:
       fetch-depth: 0
-  - uses: volker.raschek/ah-annotations@v1
+  - uses: volker.raschek/ah-annotations@v0.0.1
 ```
 
 ### Explicit tags
@@ -26,10 +26,10 @@ Pass `old-tag` and `new-tag` to control the commit range:
 
 ```yaml
 steps:
-  - uses: actions/checkout@v4
+  - uses: actions/checkout@v7.0.1
     with:
       fetch-depth: 0
-  - uses: volker.raschek/ah-annotations@v1.0.0
+  - uses: volker.raschek/ah-annotations@v0.0.1
     with:
       old-tag: v1.0.0
       new-tag: v2.0.0

install-yq.sh

@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-internal_yq_version=v4.44.6 # renovate: datasource=github-releases depName=mikefarah/yq versioning=semver
+internal_yq_version=v4.53.3 # renovate: datasource=github-releases depName=mikefarah/yq versioning=semver
 
 # Use :- for unset and handle empty strings from composite action inputs
 YQ_BINARY_NAME="${YQ_BINARY_NAME:="yq"}"

renovate.json

@@ -13,7 +13,7 @@
         "^README\\.md$"
       ],
       "matchStrings": [
-        "uses: volker\\.raschek/ah-annotations@(?<currentValue>[^\\s\"']+)"
+        "uses: volker\\.raschek\/ah-annotations@(?<currentValue>[^\\s\"']+)"
       ],
       "depNameTemplate": "volker.raschek/ah-annotations",
       "packageNameTemplate": "https://git.cryptic.systems/volker.raschek/ah-annotations",
@@ -41,6 +41,7 @@
       ],
       "automerge": true,
       "matchDepNames": [
+        "actions/checkout",
         "volker.raschek/ah-annotations"
       ],
       "matchUpdateTypes": [