Make 'abandonment' a more involved + reliable check

[jamietanna]

Renovate's 'abandonment' functionality is reasonable, but has some improvements to make to make sure that we're giving our users the clearest view of whether they should be "worried" about an abandonment.

As discussed in #42727, and noted in https://social.treehouse.systems/@dalias@hachyderm.io/116932451629129149, there are a few issues with our current view:

• we only look at recent releases
• a project may be active (and the maintainer responding to issues) but no releases have been needed
• a project may be inactive because it's feature complete

To improve this, we should perform some tweaks to "Abandonment" as a concept:

• Note that it's possibly abandoned
• Introduce other checks to provide other signals to whether a project is unmaintained
  • Likely as an Enrichment module
  • Use source repository status for Abandonment flagging #42757
  • Abandonment heuristic produces false positives for mature tools with server-side data (e.g., govulncheck) #42727
  • I.e. OpenSSF's Maintained score
• Allow for packageRules-based ovrrides
  • Per-package overrides for abandonments & community-sourced abandonments #40977
• Create a "Key Concepts" page for it

(This is something I've been thinking about for a while, and after a listen to https://opensourcesecurity.io/2026/2026-07-VCRI-josh-marpet/ today alongside https://social.treehouse.systems/@dalias@hachyderm.io/116932451629129149, now's the time to raise this)

The CHAOSS Community does not currently have a metric for this, so looking at Value Chain Risk's suggested metrics may be a good step here.

See also:

• https://nesbitt.io/2026/05/08/weekend-at-bernies.html
• https://valuechainrisk.org/state-of-supply-chain/2026-Q2/two-clocks.html