chore: migrate dependency updates from Dependabot to Renovate

[ivorisoutdoors]

What changes for dependency PRs

• Who opens them: the org Renovate GitHub App instead of dependabot[bot].
• When: monthly → monthly (the 1st, UTC). Tick an update in the Dependency Dashboard issue to get it early.
• Grouping: one github-actions dependencies PR. Major updates land in the same PR. No custom groups kept.
• Coverage: newly updated: none. No longer updated: none.
• Versions: Renovate bumps the range in the manifest, not only the lockfile. It leaves engines, the Go go directive, requires-python, and Terraform required_version alone.
• Limits: no cap on open PRs.
• Labels and commits: renovate and dependencies labels; runtime dependency PRs commit as fix(deps), which cuts a patch release under release-please, and all other PRs as chore(deps).
• Dropped: commit-message prefix ci: the repo has no release tooling, so the preset's semantic commits apply. The actions group: it took every dependency, which the default grouping already does.
• Security updates: Dependabot security updates are a repo setting and keep running if enabled.

After merging

• Add the renovate topic so the org Renovate operator picks up this repo: send @Botzo repo topic add renovate to articulate/docker-python in Slack. Nothing opens until the topic is set. Re-running it is harmless.

Notes

• The dockerfile manager is off because the image pins its base-image major on purpose.
• .github/workflows/auto-merge.yaml still matches dependabot[bot] and articulate-automation[bot] but not the Renovate bot, so Renovate PRs will not be auto-merged. Left unchanged as the skill requires; the owner should decide whether to add the Renovate bot.