chore: add Renovate for security-only dependency updates

[maia-cloud-agent]

Summary

Add Renovate configured for security-only dependency updates.

• Disables all regular dependency update PRs (no routine version-bump noise)
• Enables OSV vulnerability alerts — Renovate will only create PRs when a dependency has a known CVE/security advisory
• Uses the security:only-security-updates pattern from Renovate's official security presets

Config

{
  "extends": ["config:recommended"],
  "osvVulnerabilityAlerts": true,
  "packageRules": [{ "enabled": false, "matchPackageNames": ["*"] }],
  "vulnerabilityAlerts": { "enabled": true }
}

---

Note

Low Risk
Adds CI/automation config only; no application runtime, auth, or data-path changes.

Overview
Adds a new renovate.json so Renovate can run against the repo with security-focused behavior only.

It extends config:recommended, turns on OSV and vulnerabilityAlerts, and uses a catch-all packageRules entry that disables updates for every package so routine version-bump PRs should not be opened—only vulnerability-driven updates are intended.

^{Reviewed by Cursor Bugbot for commit 730d007. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Approved: Cursor Bugbot completed successfully with no findings. No approval policies apply to this renovate.json-only change. No reviewers assigned (reviewer assignment tool unavailable).

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}