chore: switch from Dependabot to Renovate

Renovate offers stronger primitives for a low-churn plugin:
- Group all GitHub Actions updates into a single weekly PR
- Group all dev-dependency minor/patch updates into one PR and
  auto-merge them once CI is green
- Auto-merge runtime patch updates; minor/major still gated on review
- Pin @opencode-ai/plugin to manual review (plugin contract changes
  must not land silently)
- Weekly lockfile maintenance to keep package-lock.json fresh
- Vulnerability alerts auto-merge on any schedule

Replaces .github/dependabot.yml. The Renovate GitHub App must be
installed on the repo (https://github.com/apps/renovate) for the
config to take effect.