ci: add renovate auto-approve workflow

[jimisola]

Summary

• Add caller workflow for the centralised Renovate auto-approve reusable workflow in reqstool/.github
• When Renovate opens a PR, this workflow approves it using `GITHUB_TOKEN`, satisfying the required-review branch protection rule
• Unblocks Renovate's existing auto-merge setting so PRs merge automatically once checks pass

🤖 Generated with Claude Code

To fix the problem, add an explicit permissions block to the workflow so that the GITHUB_TOKEN is limited to the least privilege required. Since we do not see any specific operations being performed in this file (it only calls a reusable workflow), the safest generic baseline is to set all permissions to read-only (or fully disable them with permissions: {}) unless we know that Renovate auto-approval needs to write to pull requests. Auto-approving a PR usually requires pull-requests: write, and possibly contents: read to access commit/PR data.

The best minimal change without altering existing behavior is to define permissions at the workflow root so they apply to all jobs (there is only approve here). For a Renovate auto-approve workflow, a reasonable least-privilege set is:

• contents: read – allow reading repo contents/metadata.
• pull-requests: write – allow approving PRs.

Concretely, in .github/workflows/renovate-approve.yml, add a permissions: block between the name: and on: keys, e.g. starting at a new line after line 1. No imports or additional definitions are needed; this is just YAML configuration.