🧰⬆️ Bump CI deps and tame YAML lint tantrums

Fresh PLANTUML, pinned SCP action, and a shiny pre-commit lineup because “latest” is a lifestyle, not a strategy.

.gitea/workflows/render.yaml

@@ -1,6 +1,7 @@
+---
 name: Render diagram
 
-on:
+on: # yamllint disable-line rule:truthy
   pull_request:
     types: [opened, reopened, edited]
   workflow_call:
@@ -9,7 +10,7 @@ jobs:
   render:
     runs-on: ubuntu-latest
     env:
-      PLANTUML_VERSION: '1.2025.4'
+      PLANTUML_VERSION: '1.2025.10'
     steps:
       - name: Check out repository code
         uses: actions/checkout@v4