Refresh Renovate workflow and policy

[vexdev]

Summary

• update the self-hosted Renovate workflow to current actions and replace the archived GitHub App token action
• upgrade the Renovate runner from renovatebot/github-action@v39.2.1 to v44.0.2
• tighten the in-repo Renovate policy with best-practice presets, weekday scheduling, grouping, and dashboard approval for major release-tool updates

Why

The existing Renovate workflow was using older action versions and a minimal config that left most update behavior implicit. This makes maintenance noisier and a little more brittle than it needs to be.

Config changes

• use config:best-practices and enable the dependency dashboard
• run in the repo timezone (Europe/Zurich) during a weekday morning window
• group GitHub Actions, Gradle, and release-tool updates into fewer PRs
• require dashboard approval for major npm release-tool upgrades
• keep PR creation behind status checks with prCreation=not-pending

Validation

• jq . .github/renovate.json
• npx --yes --package renovate renovate-config-validator --strict .github/renovate.json