Add Renovate config following the jardinero model

[cbascom]

Adds a renovate.json so the repo gets managed dependency updates before it goes public, following the model already in use on the public LuxorLabs/jardinero repo and adapting it to this repo's Python/uv toolchain.

Carried over from jardinero's config: config:recommended, a weekend schedule, a 14-day minimumReleaseAge gate with internalChecksFilter: strict, majors parked on the dependency dashboard (dependencyDashboardApproval), lockFileMaintenance for the lockfile, OSV vulnerability alerts, security-labeled vuln PRs, and prConcurrentLimit: 5.

Adapted for this repo:

• lockFileMaintenance targets uv.lock.
• grpcio / grpcio-tools / protobuf are grouped (the generated bindings target a protobuf runtime, so they're version-coupled), and pytest / pytest-asyncio are grouped.
• Non-major updates batch into one PR; 0.x packages get their own PR since a minor/patch there can break like a major.
• The github-actions manager is disabled — SHA pins are managed manually, matching the repo's "require actions pinned to a full-length commit SHA" setting, so Renovate won't open digest-bump PRs that run CI under an unreviewed SHA.

Config validated with renovate-config-validator. The Renovate GitHub App will be installed on this repo after merge.

🤖 Generated with Claude Code

[tenki-reviewer]

Review complete. No issues found — approved ✅.

---

This change introduces renovate.json, configuring automated dependency updates for the Python SDK. It sets a 14-day minimum release age gate, weekend update schedules, grouped minor/patch PRs, and per-package rules that keep pre-1.0.0 dependencies batched separately while major bumps remain individual PRs.

Files	Change
renovate.json	New Renovate config: schedule, minimumReleaseAge, package grouping rules, lockfile maintenance, and vulnerability alerts.

One latent issue in package-rule ordering (a later null groupName rule potentially overriding the batching rule for <1.0.0 packages) was noted during review but did not meet the confidence threshold to report inline; the overall configuration is sound and safe to merge.

_{Reviewed commit: b97c436}