Fix Renovate S6 tracking, bump S6 to 3.2.3.0, improve layer caching

[modem7]

Summary

1. Renovate S6 tracking fix (renovate.json)
Add versioningTemplate: "loose" to the S6 overlay custom manager. S6 uses 4-part version numbers (3.2.0.2, 3.2.3.0) which aren't valid semver — without loose versioning, Renovate silently skips updates it can't parse.

2. S6 bumped to 3.2.3.0 (Dockerfile)
Manually bumped since Renovate hasn't been opening PRs for it.

3. Dockerfile layer reorder for better cache utilisation

Before:

ADD S6 files → RUN (apk upgrade + S6 extract + apk add) → COPY requirements.txt → RUN pip install

A S6 bump invalidated the slow apk add (55 packages) and pip install layers every time.

After:

RUN apk upgrade + apk add → ADD S6 files → RUN S6 extract → COPY requirements.txt → RUN pip install

Now each concern is an independent cacheable layer:

• S6 bump → only S6 extract + pip rebuild (apk cached)
• requirements.txt change → only pip rebuilds (apk + S6 cached)
• apk package update → only apk + everything after rebuilds (but S6 and pip layers are unaffected by apk index changes)

Also adds --mount=type=cache,id=apk-${TARGETARCH} to the apk step, consistent with the existing pip cache mount.

Test plan

• S6 version updated to 3.2.3.0 in Dockerfile
• versioningTemplate: "loose" added to S6 custom manager in renovate.json
• Layer order verified: apk before S6 ADD
• CI build passes with new S6 version and layer order
• Renovate opens future S6 update PRs automatically