chore(ci): replace dependabot with renovate

[ThePrismSystem]

Renovate takes over version and security updates. GitHub's automated security fixes are
switched off so the two don't open duplicate PRs for one CVE; Dependabot alerts stay on,
because Renovate reads them to learn what is vulnerable.

Note this repo never actually ran Renovate before. A renovate.json was committed back in
051bb2f and produced zero PRs across the whole history — no onboarding PR, no dashboard
issue, no renovate/* branches — because the GitHub App was never installed. That install
is still the missing step and only you can do it: https://github.com/apps/renovate, scoped
to beans-web. This config does nothing until then.

What Dependabot could not reach

• ARG BEANS_VERSION — the only pin for the beans binary. The Dockerfile builds from it
  and CI reads it back out with sed; check:pins exists because a second pin once shipped
  an older binary than CI tested. No built-in manager covers an ARG, so a custom manager
  watches it against the go datasource — the same thing scripts/build-beans.sh installs.
  Verified: the pattern matches v0.4.2 and nothing else in the file, and all three of
  releases/tags/proxy.golang.org resolve it.
• The Node floor, stated in .nvmrc, engines.node and two Dockerfile stages. These have
  drifted before — the README badge still read >=22 after the bump to 24, which the audit
  caught. Grouped into one PR.
• Volume. 37 dependencies across four manifests, one PR each, is what produced 10
  Dependabot PRs in a short window. Non-major dev dependencies now arrive as one weekly PR.

Automerge

Dev dependencies automerge once the nine required checks pass — via GitHub's native
auto-merge, so the ruleset is the gate rather than Renovate's own judgement. Runtime
dependencies, GitHub Actions and the beans pin never automerge.

Two judgement calls worth your veto:

• Actions are not automerged. They aren't dev dependencies and they run with a token, so a
  compromised one is a credential problem rather than a build problem.
• minimumReleaseAge: 3 days on automerged updates. Automerge plus a fresh publish is the
  window an npm account takeover needs to get a malicious release merged unread. Drop it if
  you'd rather have the updates sooner.

Majors are automerged too, per "dev deps only" — but individually rather than in the group,
since a group is only as mergeable as its worst member.

Config validates against renovate-schema.json. Local gate green: format, lint, knip,
check:pins, spell.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.