fix(renovate): pin Renovate version ranges by default

[Copilot]

Pinned GitHub Actions digests could retain floating version comments like # v6. Renovate should expand floating ranges to concrete versions to avoid Zizmor findings.

• Renovate base preset
  • Added rangeStrategy: "pin" to the shared Renovate base preset.
  • This makes Renovate replace floating version ranges with concrete versions by default for supported managers, including pinned GitHub Actions.

{
  pinDigests: true,
  rangeStrategy: "pin",
}

> [!WARNING]
>
>

[DevSecNinja]

@copilot Wouldn't this be a good default for all packages that Renovate manages?

[Copilot]

@copilot Wouldn't this be a good default for all packages that Renovate manages?

Yes — I moved rangeStrategy: "pin" into the shared Renovate base preset so it applies as the default across Renovate-managed packages, and removed the GitHub Actions-specific rule. Addressed in 159c111.