chore: add Renovate for security-only dependency updates

[maia-cloud-agent]

Summary

Add Renovate configured for security-only dependency updates.

• Disables all regular dependency update PRs (no routine version-bump noise)
• Enables OSV vulnerability alerts — Renovate will only create PRs when a dependency has a known CVE/security advisory
• Uses the security:only-security-updates pattern from Renovate's official security presets

Config

{
  "extends": ["config:recommended"],
  "osvVulnerabilityAlerts": true,
  "packageRules": [{ "enabled": false, "matchPackageNames": ["*"] }],
  "vulnerabilityAlerts": { "enabled": true }
}

---

Note

Low Risk
Tooling-only change with no application runtime or auth/data paths affected.

Overview
Introduces Renovate via a new renovate.json, extending config:recommended with OSV vulnerability alerts and vulnerabilityAlerts enabled.

A catch-all packageRules entry sets enabled: false for every package (matchPackageNames: ["*"]), so Renovate should not open normal version-bump PRs—only security-related updates when alerts fire.

^{Reviewed by Cursor Bugbot for commit cdb7334. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Approved: Cursor Bugbot completed successfully with no findings requiring human review. No reviewers were assigned (reviewer assignment is not available in this run).

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}