Add the Renovate hardening content that #38 was meant to carry

[wormeyman]

Corrects #38.

What went wrong

#38 was supposed to move renovate.json5 into .github/ and harden it. It merged with only the move. The git add in that sequence named the pre-move path renovate.json5, which no longer existed after the git mv; git rejects the entire pathspec in that case and stages nothing, so the commit captured the rename alone. Its message and PR body describe settings that are not in the tree.

Net effect on main right now: the file sits at .github/renovate.json5 with its original #35 contents. Nothing is broken and nothing regressed - the six holds are intact and the config is valid - it is just missing the layer #38 claimed to add. This PR adds it.

What this adds

• helpers:pinGitHubActionDigests - all four actions are on moving tags today (actions/checkout@v7, actions/setup-node@v7, actions/setup-dotnet@v6, cloudflare/wrangler-action@v4), so the first Renovate run will open one grouped PR converting them to SHA pins.
• automerge: false, explicitly, no exceptions - with the two prerequisites written down that would have to be true before revisiting it. Neither holds on this repo today: branch protection requiring all three CI checks with strict_required_status_checks_policy, and repo-level "Allow auto-merge".
• timezone: America/Los_Angeles + schedule: ["before 6am on monday"]. Without the timezone the schedule is UTC and fires around midnight Sunday local.
• vulnerabilityAlerts with the weekly schedule cleared and a 25-hour age floor, plus osvVulnerabilityAlerts: true. Without this a CVE fix could sit ~10 days.
• prConcurrentLimit 5 -> 3.
• prBodyNotes on two holds: Verify.DiffPlex (its failure mode builds cleanly and dies at runtime, so a compiling branch is not evidence) and @types/node (names the two workflows that must move with any ceiling raise, since there is no .node-version).

lockFileMaintenance stays enabled, departing from the sibling repo's convention, with both sides of the argument recorded at the setting - the case against is pnpm-specific and does not transfer; the case for is that this is what closed the fast-uri / dompurify / brace-expansion advisories in #30.

Holds: unchanged

All six from #35 carry over verbatim - typescript <7.0.0, @types/node <25.0.0, SixLabors.ImageSharp <4.0.0, SixLabors.ImageSharp.Drawing <3.0.0, Microsoft.AspNetCore.OpenApi + Swashbuckle.AspNetCore <9.0.0 grouped, Verify.DiffPlex <3.2.0. Plus the ApplicationInsights major skip and the git-submodules disable. None added, none removed, none loosened.

Verification

Validated the exact committed blob, not the working tree, since a working-tree/index mismatch is what caused #38:

$ git show HEAD:.github/renovate.json5 > /tmp/renovate.json5
$ npx --yes --package renovate -- renovate-config-validator /tmp/renovate.json5
 INFO: Config validated successfully

Also confirmed the settings are present in the committed object (git show HEAD:... greps non-zero for automerge, timezone, vulnerabilityAlerts, osvVulnerabilityAlerts, pinGitHubActionDigests), and that exactly one Renovate config file exists in the repo.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DN9nGF1Q8fvbZv1W74JkJ6