The renovate image has been pulled by hand and the forgejo-runner will happily start the image. Both PAT and GITHUB secrets are configured as 'action secrets' within the renovate repository.
Besides the workflow, the repository contains renovate.json and config.js, so renovate has the correct configuration.