feat(renovate): add Renovate dependency update configuration

[williaby]

Summary

• Adds renovate.json to re-enable Renovate dependency updates for this repository
• The onboarding PR was previously closed without merging, which permanently disabled Renovate; this commit re-enables it
• Config inherits global settings from the self-hosted Renovate instance with GitHub Actions pinning and semantic commits

Why

Renovate marks a repo as disabled-closed-onboarding when its onboarding PR (branch renovate/configure) is closed rather than merged. The only way to re-enable it is to commit a renovate.json directly to the default branch.

Test plan

• Merge this PR
• Verify Renovate creates a Dependency Dashboard issue on the next scheduled run
• Verify no config-validation errors appear in Renovate logs

Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 27 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 5 included reviews currently available. Your 10 included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Essentials

Run ID: f4040a0f-a521-492f-9b7b-2a4a469d783f

📥 Commits

Reviewing files that changed from the base of the PR and between ca3bfe5 and 88972ba.

📒 Files selected for processing (1)

• renovate.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/add-renovate-config

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟡 Changes recommended

The Renovate config contains a semantic-commit configuration conflict and a couple of rule inconsistencies that are likely to prevent the intended Renovate behavior.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a renovate.json configuration at the repository root to re-enable Renovate-driven dependency updates after the prior onboarding PR was closed, establishing update scheduling, labeling/assignment defaults, and GitHub Actions/Python-specific rules.

Changes:

• Introduces Renovate configuration with dependency dashboard + scheduling + labeling/assignment defaults.
• Adds package rules targeting GitHub Actions updates (grouping, pinning, automerge behavior) and a rule intended to control Python version updates.
• Enables vulnerability alert handling via Renovate.

File summaries

File	Description
renovate.json	Adds the Renovate configuration to re-enable automated dependency update PRs and dashboards with repository-specific policies.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.