Fixed Renovate rebasing all open PRs during workday (#28207)

no ref

The hourly self-hosted Renovate workflow was force-pushing every open
Renovate PR on each tick, firing a fresh CI run on each — including
during the workday, despite the off-hours `schedule` block in
`renovate.json5`.

Renovate's `schedule` only gates *new PR creation*. Its
`updateNotScheduled` option defaults to `true`, which keeps existing
branches getting rebased and force-pushed any time the runner ticks.
Combined with the `'17 * * * *'` cron, that was ~30 min of Actions
compute every daytime hour plus a CI storm across all open Renovate PRs.

Changes:
- `renovate.json5`: `updateNotScheduled: false` so branch maintenance
also obeys the windows. `vulnerabilityAlerts.schedule: "at any time"`
overrides this per-block, so CVE-driven PRs continue to flow intraday.
- `renovate.yml`: replaced the hourly wildcard cron with 5 windowed
entries matching the `schedule` windows, plus one weekday 14:17 UTC tick
so the CVE path still has a runner. Roughly halves the weekly tick count
and removes ~17h/day of daytime no-op runner time.