Renovate-manage dev-kit's own pins and call renovate-auto-approve #40

Context

dev-kit has no renovate.json, so its internal action pins (nix-installer-action, cachix-action, actions/checkout, …) only move when someone bumps them by hand. It also hosts the reusable renovate-auto-approve workflow but doesn't call it itself.

Part of centralizing shared CI/build config in dev-kit: dev-kit should follow the same policy it ships to consumers.

What needs to be solved

1. Add renovate.json extending github>opendefensecloud/renovate-config.
2. Add a caller stub for renovate-auto-approve, triggered the same way consumers trigger it.

Acceptance criteria

• Renovate opens its onboarding/first PRs on dev-kit and they pass CI.
• A Renovate PR labelled automerge is auto-approved by the stub; one labelled security is not.