ci: add renovate auto-approve workflow

[jimisola]

Summary

• Add caller workflow for the centralised Renovate auto-approve reusable workflow in reqstool/.github
• When Renovate opens a PR, this workflow approves it using `GITHUB_TOKEN`, satisfying the required-review branch protection rule
• Unblocks Renovate's existing auto-merge setting so PRs merge automatically once checks pass

🤖 Generated with Claude Code

To fix the problem, add an explicit permissions: block that grants only the minimal required permissions for this workflow. Because this job only delegates to a reusable workflow via uses:, the caller should still define its own permissions; the called workflow cannot gain more permissions than the caller provides. The safest general default when you don’t know the exact needs is contents: read, which matches GitHub’s recommended minimal baseline and satisfies the CodeQL rule by explicitly constraining the GITHUB_TOKEN.

The best minimal change here is to add a permissions: section at the top level of the workflow (just under name: and before on:). This will apply to all jobs (including approve, which doesn’t define its own permissions:), without changing how the job is structured or how it calls the reusable workflow. No imports or additional methods are needed—this is purely a YAML configuration change in .github/workflows/renovate-approve.yml around lines 1–4.