ci: add automated dependency updates (Dependabot or Renovate)

[llbbl]

This repo has no automated dependency updates — no Dependabot config, no Renovate. Which is a little on the nose for a dependency-maintenance tool.

The cost showed up in the last maintenance pass: @biomejs/biome had drifted 2.5.2 -> 2.5.10 and @types/bun 1.3.14 -> 1.4.0, both found only because someone went looking. The GitHub Actions pins in #18 are the same story.

Filed separately from #18 because enabling this starts opening PRs on its own, and that is easier to evaluate in isolation than bundled into a workflow refactor.

Acceptance

• Automated update PRs open for npm dependencies and GitHub Actions
• Updates are grouped sensibly rather than one PR per package
• Update PRs run the full CI suite (including the build step added in ci: verify the binary builds before tagging a release #18)
• A schedule that is useful without being noisy

Notes

• bun.lock support in Dependabot should be confirmed before committing to it — if it cannot parse Bun's lockfile, Renovate is the fallback, as it has explicit Bun support.
• The github-actions ecosystem is independent of the npm one and works regardless, so the Actions half of this is safe either way.
• Whatever is chosen must not auto-bump the typescript-api alias (pinned to typescript@6.0.3 on purpose — see the comment in src/lib/analyzers/imports.ts). It needs an explicit ignore rule.

Tasks

• dep-1 — Confirm whether Dependabot can parse bun.lock; fall back to Renovate if not
• dep-2 — Add config covering the npm and github-actions ecosystems, with grouping and a schedule
• dep-3 — Add an ignore rule for the pinned typescript-api alias