ci(renovate): add scheduled Renovate workflow

[mwaldheim]

Summary

• add a dedicated Renovate GitHub Actions workflow at .github/workflows/renovate.yaml
• run Renovate weekly (cron: 0 5 * * 1) and via manual workflow_dispatch
• configure least-required repo permissions for Renovate to open/update PRs and dependency dashboard issues
• use RENOVATE_TOKEN when provided, otherwise fall back to GITHUB_TOKEN

Why

renovate.json is already present, but there was no workflow execution path in this repository. This PR wires up automated execution so dependency updates are actually generated.

Notes

• If you want cross-repo updates or broader API scope, add a RENOVATE_TOKEN repository secret (PAT/GitHub App token).
• For same-repo updates, GITHUB_TOKEN is used as fallback.