adopt Renovate org-wide (grouped weekly, auto-merge patch/minor on green CI)

[rubenhensen]

Install Renovate org-wide (encryption4all; plus privacybydesign/postguard-ops if permitted) with a shared config preset: grouped weekly PRs, automerge patch/minor on green CI, lockfile maintenance. Kills the manual CVE-churn tax (~11 hand-made bump PRs in a quarter in examples alone) and the rot-while-dormant failure mode (three repos rotted through 2025 and broke on wake-up).

Part of #247 (workstream F).