feat: add Renovate config for automated dependency updates

- regexManagers: tracks SAFE_SETTINGS_VERSION in workflow files
  (Dependabot can't detect env-block versions)
- safe-settings: automerge off, 7-day minimum release age
- prettier: automerge on branch (low risk, no functional impact)

Closes #6.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 2 people

renovate.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "regexManagers": [
+    {
+      "fileMatch": ["^\\.github/workflows/.+\\.yml$"],
+      "matchStrings": ["SAFE_SETTINGS_VERSION: (?<currentValue>[^\\s]+)"],
+      "datasourceTemplate": "github-tags",
+      "depNameTemplate": "github/safe-settings",
+      "versioningTemplate": "semver"
+    }
+  ],
+  "packageRules": [
+    {
+      "matchDepNames": ["github/safe-settings"],
+      "automerge": false,
+      "minimumReleaseAge": "7 days",
+      "labels": ["renovate"]
+    },
+    {
+      "matchPackageNames": ["prettier"],
+      "automerge": true,
+      "automergeType": "branch"
+    }
+  ]
+}