chore(deps): activate organization Renovate preset

[ss-o]

Summary

• activate the shared local>z-shell/.github:renovate-config preset from the default branch
• require Dependency Dashboard approval during Stage 1 so Renovate cannot open routine update PRs yet
• disable Renovate vulnerability-alert remediation so Dependabot retains security ownership
• keep .github/dependabot.yml unchanged until live Renovate processing and GitHub security settings are verified

Safety boundary

This is Stage 1 of z-shell/.github#452. Do not approve any Dependency Dashboard update while this gate is active. Stage 2 will remove routine Dependabot configuration and the dashboard-approval gate atomically only after the tracker’s live-processing, security-settings, and zero-open-routine-Dependabot-PR gates pass.

Verification

• exact JSON structure: pass
• jq empty renovate.json: pass
• git diff --check: pass
• signed focused commit: pass
• Renovate validator: identical non-Zi configuration passed the official validator in the rollout validation set

Draft until direct validator coverage and repository checks are green.

Tracks: z-shell/.github#452

[Copilot]

Pull request overview

Activates Renovate for the repository by adding a minimal renovate.json that inherits the organization’s shared preset while gating routine updates behind Dependency Dashboard approval and leaving vulnerability remediation to Dependabot.

Changes:

• Added renovate.json pointing at local>z-shell/.github:renovate-config.
• Enabled :dependencyDashboardApproval to prevent routine update PRs without explicit dashboard approval.
• Disabled Renovate vulnerability-alert remediation via :disableVulnerabilityAlerts to preserve Dependabot as the security-update owner.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.