chore: dependency hygiene — Renovate + corepack packageManager enforcement

[thymikee]

Part of #1412 (Track B).

Context

Actions are SHA-pinned (good), but there is no automated dependency updating, and every local command warns about pnpm version drift (configured 11.1.2 vs local). For a CLI executed on user machines, stale transitive CVEs are the main supply-chain gap.

Deliverables

• Renovate config: lockfile-maintenance weekly; grouped devDependencies; runtime deps as individual PRs; actions digest updates enabled; automerge OFF (the merge gate stays human — see swarm-PR lessons).
• packageManager field enforced via corepack in CI setup-node-pnpm action so local/CI pnpm versions cannot drift silently.
• One doc paragraph: how Renovate PRs are gated (check-affected plan must be green; no rubber-stamp automerge).

Labeled ready-for-human because installing the Renovate app needs repo admin.

Acceptance

• First Renovate PR opens and passes CI; pnpm drift warning gone locally after corepack enable.

Review amendments (2026-07-27)

• packageManager: pnpm@11.1.2 ALREADY exists in package.json while .github/actions/setup-node-pnpm/action.yml hardcodes its own 11.1.2 default — two sources of truth. Make package.json the single source: the action reads it (or corepack does) and CI asserts the installed pnpm version matches.
• Enable GitHub vulnerability alerts / Renovate security updates explicitly — updating dependencies is not itself vulnerability detection.