Adopt Renovate, retire Dependabot version updates

[kin0992]

Why

Dependabot version updates leave several blind spots in this repo: it doesn't reliably track the pnpm catalog in pnpm-workspace.yaml, ignores the packageManager pin and .node-version, and can't see the pinned waza CLI version/checksum in the eval workflow. Renovate covers all of these.

What

• renovate.json mirroring the previous Dependabot setup:
  • Groups: github-actions (all), dev-dependencies / prod-dependencies (non-major), and a new catalog toolchain group for the pnpm-catalog tools (oxlint, oxfmt, typescript, @types/node).
  • Weekly schedule, dependency dashboard, lockfile maintenance.
  • :semanticCommitsDisabled so update PRs follow this repo's classic commit-message convention (the commit-message skill forbids Conventional Commits).
  • Automerge for digest / pin / patch once required checks pass (viable here: 0 required approvals + Static Analysis (self) check, allowAutoMerge already on).
  • Custom regex manager bumping WAZA_VERSION (see risk below).
• Removed .github/dependabot.yml to avoid duplicate PRs.

How to verify

• renovate-config-validator passes (Config validated successfully).
• After merge + installing the Renovate app, the Dependency Dashboard issue appears and the first onboarding/update PRs open.

Risks / follow-ups

• Action required: Renovate only runs once the Mend Renovate GitHub App is installed on the repo (or a self-hosted Renovate action is added). The config alone is inert until then.
• WAZA_SHA256 is not auto-updated — no datasource exposes the binary hash. Renovate bumps WAZA_VERSION and opens the PR; the checksum must be refreshed by hand. The eval job's existing sha256sum -c guard fails the PR safely if it's forgotten.
• Dependabot security alerts / security updates (Pulumi-managed) are untouched and still operate; only version-update PRs move to Renovate. Minor overlap with Renovate's own vulnerability handling is expected and harmless.

[changeset-bot]

⚠️ No Changeset found

Latest commit: d36d27c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR