build(renovate): resolve ferrlabs-* crates from crates.io instead of Kellnr

[BryanFRD]

Part of FerrLabs/Kit#294. Every Kit crate is on crates.io now, and the product repos are dropping registry = "kellnr" from their manifests.

The ferrlabs-* cargo rule carried registryUrls pointing at Kellnr as a fallback. A registryUrls on a package rule overrides the registry the manifest declares, so once a product moves its deps to crates.io this would have kept Renovate looking for updates on Kellnr, then failing outright once Kellnr is shut down. Removed, and the description, which explained the Kellnr workarounds, now says why none are needed.

snippets/deny.toml, the template repos copy from, drops Kellnr from its registry allowlist for the same reason as each product.

The in-cluster runner still sets CARGO_REGISTRIES_KELLNR_INDEX and allowCustomCrateRegistries; those go with the Infra change that retires Kellnr itself.

renovate-config-validator passes.

[ferrfleet]

Checked the premise against crates.io: all 11 ferrlabs-* crates are published there (api-version, cache, crypto, db, errors, http, id, mail, oauth, ratelimit, types), last pushed 2026-09-20/21. Dropping registryUrls is correct, and the ordering is safe: a product repo that still declares registry = "kellnr" keeps resolving through CARGO_REGISTRIES_KELLNR_INDEX, which the runner still supplies, so nothing goes dark between this merge and the Infra change.

The !/^ferrlabs-/ negation on the third-party Cargo rule below is unaffected, so these crates keep the no-wait automerge policy rather than falling into the 1-day quarantine.

One nit on snippets/deny.toml.

[ferrfleet]

Nit: the same migration retires the license exception a few lines up. Every published version of all 11 ferrlabs-* crates on crates.io declares MPL-2.0, which is already in this allow list, and none declares LicenseRef-FerrLabs-Proprietary. A repo still consuming Kit via git + rev is rejected by unknown-git = "deny" with an empty allow-git before the license is ever evaluated, so the entry doesn't cover that path either.

Dropping lines 24-26 (the two comment lines and "LicenseRef-FerrLabs-Proprietary",) in the same pass would keep the snippet honest. Not doing it only widens the license policy for something nothing declares, hence the nit rather than a blocker.

I can't read FerrLabs/Kit (private), so this is based on the crates.io metadata only: if the in-repo manifests still carry the proprietary license and some repo consumes them in a way I haven't seen, keep the entry.