chore(deps): activate organization Renovate preset

[ss-o]

Summary

• activate the shared local>z-shell/.github:renovate-config preset from the default branch
• require Dependency Dashboard approval during Stage 1 so Renovate cannot open routine update PRs yet
• disable Renovate vulnerability-alert remediation so Dependabot retains security ownership
• keep .github/dependabot.yml unchanged until live Renovate processing and GitHub security settings are verified

Safety boundary

This is Stage 1 of z-shell/.github#452. Do not approve any Dependency Dashboard update while this gate is active. Stage 2 will remove routine Dependabot configuration and the dashboard-approval gate atomically only after the tracker’s live-processing, security-settings, and zero-open-routine-Dependabot-PR gates pass.

Verification

• exact JSON structure: pass
• jq empty renovate.json: pass
• git diff --check: pass
• signed focused commit: pass
• Renovate validator: identical non-Zi configuration passed the official validator in the rollout validation set

Draft until direct validator coverage and repository checks are green.

Tracks: z-shell/.github#452

[Copilot]

Pull request overview

This PR introduces an initial Renovate configuration for the repository, aligning it with the organization’s shared preset while gating routine update PR creation behind Dependency Dashboard approval and keeping Dependabot as the owner of security/vulnerability remediation.

Changes:

• Add renovate.json extending the shared org preset (local>z-shell/.github:renovate-config).
• Require Dependency Dashboard approval (:dependencyDashboardApproval) to prevent routine Renovate PRs until explicitly approved.
• Disable Renovate vulnerability-alert remediation (:disableVulnerabilityAlerts) to keep Dependabot responsible for security updates.