chore(#4007): group Cloudflare packages in Renovate config

[fullsend-ai-coder]

Add a packageRules entry to renovate.json that groups all Cloudflare npm packages (@cloudflare/*, wrangler, miniflare) under a single "cloudflare-workers" group. This prevents broken lockfile-only PRs caused by peer dependency conflicts when Renovate updates Cloudflare packages individually.

PR #3453 demonstrated this failure: a lockfile-only update for @cloudflare/vitest-pool-workers pulled in wrangler@4.x, which requires @cloudflare/workers-types@^5.x as a peer dependency while package.json still pinned ^4.x.

---

Closes #4007

Post-script verification

• Branch is not main/master (agent/4007-group-cloudflare-renovate)
• Secret scan passed (gitleaks — 1e0b37eebf2aff1964d5751826d60db9cfbd5341..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[github-actions]

Site preview

Preview: https://20d9f94c-site.fullsend-ai.workers.dev

Commit: 814aa6f7181cc4c71ea22445bef91a4f0eefb229

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 11:04 AM UTC · Completed 11:10 AM UTC
Commit: 814aa6f · View workflow run →

[fullsend-ai-retro]

PR #4013 represents an exemplary end-to-end improvement loop: a previous retro analyzed the CI-failing Renovate PR #3453, identified that Cloudflare packages need grouping in renovate.json, filed issue #4007, which was triaged, coded, human-approved, and merged — all within 22 minutes and zero rework iterations. The code change (5 lines adding a packageRules group) was correct and minimal.

No review agent dispatched — this is a known gap tracked in #3996 and #3998. The human (rh-hemartin) approved directly.

One novel finding: this workflow serves as a counterexample to #4006 and #3951, which propose skipping retro on all dependency bot PRs. The retro on closed-without-merge Renovate PR #3453 produced the high-value issue #4007 that led to this fix. If those proposals were implemented as currently scoped, this improvement would never have been automated.

Proposals filed

• Evidence for #4006 and #3951: retro on CI-failing Renovate PR produced high-value config fix that would be lost under blanket bot-PR skip (in fullsend-ai/fullsend)