chore: inline self-contained house Renovate config (#8)

Replace bare `config:recommended` with the full inlined house Renovate
config.

- Built on public presets only (`config:best-practices`,
`:dependencyDashboard`, `:semanticCommits`, vuln alerts).
- Self-contained — no `github>...` / `local>...` cross-repo references.
- Standardizes config across all modifiable repos (CANARY for rollout).

Validated with `renovate-config-validator`.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

## Chores

* Enhanced dependency automation configuration to enforce safer update
practices: minor and patch updates auto-merge upon successful CI, major
updates require manual review, and vulnerability alerts are
automatically merged. Lock file maintenance is now scheduled weekly.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Author: bakerboy448

renovate.json

@@ -1,6 +1,20 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended"
-  ]
+  "description": "Inlined house Renovate config — self-contained, public presets only.",
+  "extends": ["config:best-practices", ":dependencyDashboard", ":semanticCommits", ":enableVulnerabilityAlertsWithLabel(security)"],
+  "schedule": ["before 6am on sunday"],
+  "timezone": "America/Chicago",
+  "prHourlyLimit": 2, "prConcurrentLimit": 4,
+  "labels": ["dependencies", "renovate"],
+  "rangeStrategy": "bump", "separateMajorMinor": true, "separateMinorPatch": false,
+  "automerge": false, "platformAutomerge": false, "rebaseWhen": "behind-base-branch",
+  "branchPrefix": "renovate/", "ignoreDeps": [],
+  "vulnerabilityAlerts": {"labels": ["security"], "schedule": ["at any time"], "automerge": true},
+  "packageRules": [
+    {"description": "Group GHA minor/patch/digest — automerge when CI green", "matchManagers": ["github-actions"], "matchUpdateTypes": ["minor","patch","digest","pin","pinDigest"], "groupName": "github-actions", "groupSlug": "github-actions", "semanticCommitType": "chore", "automerge": true},
+    {"description": "GitHub Actions major — hold for review", "matchManagers": ["github-actions"], "matchUpdateTypes": ["major"], "automerge": false, "addLabels": ["review-required"]},
+    {"description": "Any major — hold for review", "matchUpdateTypes": ["major"], "automerge": false, "addLabels": ["major","review-required"]}
+  ],
+  "lockFileMaintenance": {"enabled": true, "schedule": ["before 6am on sunday"], "automerge": true, "automergeType": "branch"},
+  "recreateWhen": "auto"
 }