ci: let Renovate own security updates so lockfiles stay in sync

[CatOfJupit3r]

Closes #43

Changes

• .github/renovate.json
  • Removed :disableVulnerabilityAlerts from extends.
  • Added a vulnerabilityAlerts block: addLabels: ["security"], schedule: ["at any time"] (not bound to the weekly schedule), and minimumReleaseAge: "1 day". Renovate's vulnerabilityAlerts default sets minimumReleaseAge: null, which would override the package rule, so the setting has to be explicit to keep the 24-hour quarantine.
  • Added packageRules with allowedVersions:
    • typescript <7 (not scoped by file, so it also covers examples/*). TypeScript 7 lacks the compiler API typescript-eslint needs.
    • fumadocs-twoslash <4. v4 imports typescript/unstable/sync, which only TypeScript 7 provides.
• Deleted .github/dependabot.yml.
• MAINTAINERS.md and SECURITY.md now say Renovate owns routine and security updates, and that Dependabot alerts stay enabled. The previous text described Dependabot monthly PRs and exact-tag Actions pins, which no longer matched the repository.

Validation

• npx --yes --package renovate@latest -- renovate-config-validator .github/renovate.json passes (Renovate 44.164.6).
• pnpm format:check passes.

Manual repository settings (after merge)

1. Settings → Code security: turn off Dependabot security updates.
2. Keep Dependabot alerts on. Renovate reads them to create vulnerability PRs, so the Mend Renovate app needs read access to Dependabot alerts.
3. Optionally close the stale Dependabot PRs build(deps): bump the npm_and_yarn group across 2 directories with 1 update #35–build(deps): bump next from 16.3.3 to 16.3.6 in the npm-security group across 1 directory #37 once Renovate opens its replacements.