Add PR CI and Renovate config

[cpepper96]

Nothing validated pull requests before now: publish.yml runs only on a v*.. tag, so a broken typecheck surfaced at release time. ci.yml runs npm ci + npm run typecheck on every PR and on main.

Renovate runs as the free Mend-hosted app (no license key needed for public repos). Config choices, and why:

• No automerge. Typecheck genuinely proves the npm devDependencies safe, but nothing validates publish.yml or flake.lock until they are used, so "green" would not mean the same thing across the three surfaces.
• Batched by risk, not by surface. @earendil-works/pi-coding-agent is pre-1.0 and on a fast release train, and it is the only dependency that can break the typecheck, so it gets a PR to itself. typescript and @types/node move as one toolchain. Both actions serve the one publish workflow.
• One weekly window (Sunday 6pm, America/Los_Angeles). Renovate always proposes the newest version, so several pi releases inside a week collapse into a single PR. Vulnerability PRs stay unscheduled.
• security:minimumReleaseAgeNpm adds a 3-day soak, which blunts the publish-malware-then-yank attack on the fastest-moving dependency.
• lockFileMaintenance on for nix, off for npm. flake.nix tracks a branch tip, so a lock refresh is the only way flake.lock ever moves, and per docs/nixpkgs-nono-sync.md that refresh is how this repo picks up a newer nono. Its schedule is set explicitly because the option ships its own default window that would override the one above. package-lock.json is the opposite case: it ships to nobody, the ~140 transitive packages under pi are never executed by tsc --noEmit, and refreshing it would only generate large diffs to hand-review.
• peerDependencies disabled, last so it overrides. The peer range is this extension's compatibility claim; it should rise when the code adopts an API that needs it, not because a new pi shipped.

The nix manager is beta. If flake.lock PRs never appear, suspect the known install-tool nix failure on the hosted runner, not this config.