chore: migrate dependency updates from Dependabot to Renovate

[ivorisoutdoors]

What changes for dependency PRs

• Who opens them: the org Renovate GitHub App instead of dependabot[bot].
• When: monthly → the 1st of the month (UTC). Tick an update in the Dependency Dashboard issue to get it early.
• Grouping: github-actions dependencies and gomod dependencies, except the groups below. Major updates land in the same PR. Custom groups kept: hashicorp (github.com/hashicorp/**) and dev (github.com/stretchr/testify).
• Coverage: newly updated: none. No longer updated: none.
• Versions: Renovate bumps the range in the manifest, not only the lockfile. It leaves engines, the Go go directive, requires-python, and Terraform required_version alone.
• Limits: no cap on open PRs.
• Labels and commits: renovate and dependencies labels; github-actions PRs commit as ci and gomod PRs as deps, as before, so release-please cuts no release for them.
• Dropped: directory: Renovate scans the whole repo; open-pull-requests-limit: 25: org default has no cap; the catch-all actions and app groups: covered by the default per-manager grouping.
• Security updates: Dependabot security updates are a repo setting and keep running if enabled.

After merging

• Add the renovate topic so the org Renovate operator picks up this repo: send @Botzo repo topic add renovate to articulate/docker-bootstrap in Slack. Nothing opens until the topic is set. Re-running it is harmless.

Notes

• The dockerfile manager is off because the image pins its base-image major on purpose.
• The hashicorp and dev rules describe their effect only; the repo does not show why they exist, so the owner can supply the reason.
• .github/workflows/auto-merge.yaml still matches dependabot[bot] and was left alone. Renovate PRs are authored by the org Renovate app, so auto-merge will not cover them until that workflow is updated.