chore(renovate): weekly grouped updates, gate runtime majors

[manast]

Why

Renovate opens far more PRs than anyone can review (nandu alone opened about 20 in two days). Every PR needs an approving review under our SOC 2 rulesets, so the volume has to come down, not the bar.

What this changes

Before	After
A PR per package, any day	One weekly PR with all non-major updates (npm + GitHub Actions), Monday morning (Europe/Madrid)
Runtime majors open automatically	Runtime majors (incl. overrides/resolutions, which hit every consumer) are only created after ticking them on the Dependency Dashboard issue
Dev/CI majors any day	Dev/CI majors: one PR per package, at most once a month
Brand-new releases proposed immediately	minimumReleaseAge: 3 days: a release must be 3 days old before Renovate proposes it (protects against compromised or yanked releases)
Lockfile drift	Weekly lock file maintenance
	At most 5 open Renovate PRs, 2 new per hour

Security fixes are unchanged: vulnerability alerts (GitHub + OSV) still open PRs immediately, ignoring the schedule and the release-age wait, and get a security label.

The daily automated Renovate review keeps running on top of this: it merges what passes, and labels the rest Need human with a reason.

Before merging

• I couldn't run renovate-config-validator from my environment (the npm registry blocks the renovate package there). All options used are standard Renovate options. Renovate validates the config when it next runs and opens a "Config Validation" issue if anything is off.
• This PR was opened from the manast account, so the ruleset requires someone else to approve it.

Repo-specific notes

This replaces the "group everything into one PR" config (#58). With every update in a single PR, one runtime major or failing test (as in #65: bullmq 6, ioredis 6, typebox 0.34, failing Bun tests) blocks all updates, including safe patches. The new config keeps the low volume (one weekly non-major PR), but majors no longer hold everything else back.

After merging, close #65. Renovate will recreate the safe part as the weekly non-major PR and list the majors on the Dependency Dashboard.

🤖 Generated with Claude Code

https://claude.ai/code/session_013btshYMGsbCH2dibYhx8qS

---

Generated by Claude Code

[Copilot]

Copilot review overview

🟡 Changes recommended

The new schedules use Renovate’s deprecated natural-language syntax instead of the supported cron format.

Review effort: Balanced
Findings: 3

Open (3)

• Use cron syntax instead of deprecated Renovate schedule syntax · New
• Use cron syntax for the lockfile schedule · New
• Replace deprecated monthly schedule syntax with cron · New

What changed in this PR

Reconfigures Renovate to reduce dependency-update noise while preserving immediate security remediation.

Changes:

• Groups non-major updates into a weekly PR.
• Gates runtime majors and schedules tooling majors monthly.
• Adds release-age, lockfile-maintenance, and PR limits.

File	Description
renovate.json	Defines the revised Renovate scheduling, grouping, approval, and security policies.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.