ci: replace Dependabot with Renovate (single-PR dependency updates)

[adamXbot]

Why

Dependabot has been unhelpful here: its pnpm support left pnpm-lock.yaml stale (needing a manual regen), and it fanned each ecosystem into separate, mutually-conflicting PRs — merge one and the rest's lockfiles conflict. This switches routine dependency updates to Renovate, which regenerates the lockfile natively and produces one grouped PR.

What changed

• renovate.json (new) — semver-safe. Bundles every non-major update across all four ecosystems (npm, cargo, docker, github-actions) into a single PR on a stable branch, with native pnpm-lock.yaml regen. Major upgrades are parked on the Dependency Dashboard (dependencyDashboardApproval) for one-at-a-time review. Weekly Monday schedule (Australia/Melbourne); the app's own published image in the deploy compose files is ignored.
• .github/workflows/renovate.yml (new) — self-hosted runner: weekly cron + a workflow_dispatch dry-run button that previews the PR without opening it. Header documents the token requirement and the hosted-app alternative.
• .github/dependabot.yml (removed) — superseded; leaving it would duplicate Renovate's PRs.
• .github/workflows/codeql.yml — adds a paths-filtered pull_request trigger so dependency PRs get a pre-merge CodeQL scan. Broad PR scanning stays off to respect the free-tier cost tradeoff.
• AGENTS.md — documents the Renovate setup so it isn't reverted.

Testing done

• renovate-config-validator → Config validated successfully.
• Workflow YAML + expressions validated (no tabs, balanced ${{ }}).

⚠️ Admin action required before this is useful (pick ONE)

PRs opened with the default GITHUB_TOKEN do not trigger on: pull_request CI (GitHub recursion guard), so an update PR would show green with no checks. To fix:

1. Add a RENOVATE_TOKEN secret (fine-grained PAT / GitHub App token with contents + PRs + workflows) — the workflow uses it and CI fires. Dry runs work today with no token., or
2. Install the hosted Mend Renovate GitHub App — its PRs trigger CI automatically; if you do this, delete renovate.yml (same renovate.json drives it).

Also: once Renovate is live, turn off "Dependabot security updates" in repo Settings so security PRs aren't duplicated (Renovate's vulnerabilityAlerts takes over).

How to test

Actions ▸ Renovate ▸ Run workflow, leave dryRun: full → the logs show the exact single PR it would open (incl. the lockfile bump) without creating anything. Flip to null to go live.

🤖 Generated with Claude Code