Ship Renovate config to keep deploy.yml.template GHA actions current

[yukimemi]

Context

pj-firebase ships .github/workflows/deploy.yml.template (kata source for the consumer's deploy.yml), and that file currently uses Node 20 actions:

• actions/checkout@v4
• actions/setup-node@v4
• pnpm/action-setup@v4
• FirebaseExtended/action-hosting-deploy@v0

Per GitHub's deprecation notice, Node 20 will be removed from runners on 2026-09-16. Without Renovate scanning pj-firebase, the template (and every downstream consumer) drifts silently until something breaks.

Surfaced from yukimemi/kakeizu PR #2 CI annotations — the consumer hit the deprecation warning and there's no automation pulling fixes upstream.

Proposed change

Mirror the pj-rust Renovate pattern:

1. Add renovate.json to pj-firebase (kata-shipped via [[file]], how = "overwrite", when = "always").
2. Use customManagers (regex) to scan **/*.template workflow files so Renovate picks up uses: lines despite the .template suffix.
3. Add a packageRules block that disables Renovate on consumer-side .github/workflows/deploy.yml so:
   • the template repo gets the bump first (single source of truth),
   • consumers pick it up via the next kata apply rather than diverging locally.
   • Note: deploy.yml is when = "once" so it's consumer-owned after init — the ignore rule is mostly belt-and-suspenders, but matches the pj-rust convention.
4. Bump the deprecated actions in deploy.yml.template itself (one-shot for the immediate Node 20 issue).

Scope check

• pj-base / pj-pnpm / pj-react-web — no workflow templates, no renovate config needed there.
• Only pj-firebase (and any future layer that ships its own workflow templates) needs this.

Consumer follow-up (kakeizu side, separate)

• After this lands and a fresh kata apply updates renovate.json, ensure Renovate App is installed/active on yukimemi/kakeizu (PR Ship Renovate config to keep deploy.yml.template GHA actions current #1 "Configure Renovate" was closed unmerged).
• If immediate Node 20 fix is wanted before the template update, manually bump kakeizu's deploy.yml actions in a one-off PR.

Reference

• pj-rust Renovate config: https://github.com/yukimemi/pj-rust/blob/main/renovate.json