chore: adopt the org Renovate policy

[ClayMav]

Problem

This repo has no Renovate config, so nothing keeps its dependencies or GitHub Actions current. The org's other subscribed repos already extend the org policy in wherobots/ci-tools. This public repo was left out because the template sync only covers internal repos.

Solution — and why this one

Add a root renovate.json5 that extends github>wherobots/ci-tools//renovate-config/default.json5, the same file the other repos use. The org policy then applies here: one grouped non-major PR, majors gated behind the Dependency Dashboard, security fixes right away (driven by Dependabot alerts, so those need to stay enabled), a 14-day release cooldown and SHA-pinned Actions. Policy changes in ci-tools reach this repo without another edit here.

Alternatives considered

• Dependabot: rejected. The org standardized on Renovate, and running both opens duplicate PRs.
• Copy the policy into this repo: rejected. It would drift from ci-tools.

Proof it works

Schema validation:

$ npx --package renovate@latest -- renovate-config-validator --strict renovate.json5
 INFO: Config validated successfully against 1 file(s)

A local Renovate run against this branch resolves the org preset and extracts dependencies (npx renovate@latest --platform=local, with a github.com host rule so it can read the ci-tools preset):

Dependency extraction complete: github-actions=19 pep621=20 pre-commit=4 renovate-config=1

What I did NOT test / where this is weakest

• Merge wherobots/ci-tools#182 first. This is a PyPI library, and without #182 the preset's Python bump rule would raise the >= floors in [project].dependencies every week, forcing them on everyone who installs it.
• The Mend app may not be enabled on this repo. If it isn't, this file does nothing until someone enables it at developer.mend.io. Merging this PR can't show that.
• This repo is public, but the preset lives in internal wherobots/ci-tools. My local run read the preset with my own token. The Mend app needs access to ci-tools to do the same. It reads it today for the internal repos, but I haven't confirmed that from a public repo.

Risk & confidence

• Risk: Low
• Confidence it's correct: High for the config. Medium that Renovate starts on its own, because Mend app enablement is outside this PR.
• Blast radius: On merge, this repo starts getting Renovate PRs and a Dependency Dashboard issue. Nothing automerges. Builds, CI and runtime are unchanged.

New dependencies

N/A: config only.

Reviewer focus

The extends path has to end in .json5. Without the extension, Renovate looks for default.json, gets a 404, and rejects the whole config.

---

Author checklist

• I read every line of this diff myself — including the parts AI wrote.
• Every section above is filled in (or explicitly "N/A — reason").
• The evidence in Proof it works actually exercises this change (not just "CI is green").

---

Authored by Claude Opus 5.5 (claude-opus-5-5) via Claude Code in T3 Code.

[ClayMav]

@salty-hambot review

[salty-hambot]

Reviewed by Salty Hambot 🤖🧂 at 90c6e68

No issues found.
_{💰 $0.0244 · 12.8k in / 861 out tokens · ⏱️ 7.7s · us.openai.gpt-6-sol high, prompt coverage-v1
💬 To request a re-review, comment @salty-hambot review}