chore(deps): adopt hybrid Renovate and Dependabot ownership

[ss-o]

Summary

• restore a conservative organization-wide Renovate preset for routine dependency version updates
• retain GitHub Dependabot for dependency alerts and security update pull requests, with an explicit no-overlap policy
• accept ADR 0012, add an operational runbook, and correct stale README references including the missing metrics/ and renovate-config.json entries
• migrate z-shell/.github itself atomically from routine Dependabot updates to the shared Renovate preset

Why

Repository-local Dependabot version-update files had drifted across schedules, grouping, ecosystems, and target branches. Renovate provides a shared organization preset and broader tuning, while GitHub remains the native authority for vulnerability alerts and security remediation.

The two services now have separate responsibilities:

• Renovate: routine dependency version updates
• Dependabot: dependency graph alerts and security update PRs

They must not both create routine updates in the same repository.

Rollout

This PR migrates only z-shell/.github. The Renovate GitHub App is installed for all organization repositories and is active. The remaining repository migrations are staged behind this PR reaching main and tracked in #452, including preservation of repository-specific behavior such as zi targeting next.

Configuration safeguards

• weekly Monday update window in UTC
• three-day minimum release age
• Dependency Dashboard enabled
• no global automerge
• five concurrent and two hourly PR limits
• non-major updates grouped by manager
• non-major GitHub Actions updates grouped separately; majors remain isolated

Verification

• Renovate config validator: both renovate-config.json and renovate.json valid
• Trunk: 8 changed policy/configuration files checked, no issues
• Lychee: 47 links checked, 0 errors
• git diff --check: clean
• README local-link and stale-reference invariants: pass
• live GitHub state: Renovate App active for all repositories
• live GitHub state: Dependabot alerts and automated security fixes enabled for z-shell/.github

Follow-up: #452 remains open until the child-repository migration checklist is completed.