deps: Renovate edits generated requirements but not uv.lock (drift risk)

[williaby]

Observed during PR backlog cleanup. Renovate security PRs (#45 mako, #46 urllib3, #47 cryptography, #48 idna) patch the generated requirements.txt/requirements-dev.txt directly, but uv.lock is the source of truth and is not updated. Risk: regenerating requirements from uv.lock reverts the security bump, and the lockfile still resolves the vulnerable version.

renovate.json currently enables pep621, pip_requirements, github-actions, pre-commit but has no uv lock-maintenance manager.

Acceptance:

• Decide the canonical layer (uv.lock vs exported requirements)
• Configure Renovate to update uv.lock (lockFileMaintenance / pep621 + uv support) so the lockfile and exported requirements stay consistent
• Document the dependency-update flow in CLAUDE.md