fix(renovate): fix openclaw digest replacement and group updates into single PR

Two fixes:
1. The regex was splitting the digest as a literal 'sha256:' prefix plus
   a captured hex group. But the docker datasource's newDigest already
   includes the 'sha256:' prefix, so the template was producing
   'sha256:sha256:...' with the previous fix, or bare hex without it
   originally. Now the regex captures the full digest value including
   the prefix, and the template outputs it as-is.

2. Added a packageRule to group tag and digest updates for
   ghcr.io/openclaw/openclaw into a single PR instead of two separate ones.

renovate.json

@@ -27,9 +27,9 @@
         "/^packages/openclaw-image/default\\.nix$/"
       ],
       "matchStrings": [
-        "  # renovate: datasource=(?<datasource>[^\\s]+) depName=(?<depName>[^\\s]+)\\n  openclawImageTag = \"(?<currentValue>[^\"]+)\";\\n  openclawImageDigest = \"sha256:(?<currentDigest>[^\"]+)\";"
+        "  # renovate: datasource=(?<datasource>[^\\s]+) depName=(?<depName>[^\\s]+)\\n  openclawImageTag = \"(?<currentValue>[^\"]+)\";\\n  openclawImageDigest = \"(?<currentDigest>[^\"]+)\";"
       ],
-      "autoReplaceStringTemplate": "  # renovate: datasource={{{datasource}}} depName={{{depName}}}\n  openclawImageTag = \"{{{newValue}}}\";\n  openclawImageDigest = \"sha256:{{{newDigest}}}\";"
+      "autoReplaceStringTemplate": "  # renovate: datasource={{{datasource}}} depName={{{depName}}}\n  openclawImageTag = \"{{{newValue}}}\";\n  openclawImageDigest = \"{{{newDigest}}}\";"
     }
   ],
   "packageRules": [
@@ -90,6 +90,16 @@
       "matchPackageNames": [
         "/google-cookie-retrieval/"
       ]
+    },
+    {
+      "description": "Group all openclaw Docker image updates into one PR",
+      "matchManagers": [
+        "regex"
+      ],
+      "matchPackageNames": [
+        "ghcr.io/openclaw/openclaw"
+      ],
+      "groupName": "openclaw"
     }
   ]
 }