ci: add central Renovate runner + renovate secrets env

[chaudharydeepanshu]

First cut of the Renovate migration (design: _playground/PLAN-renovate-migration.md).

What

• .github/workflows/renovate.yml — self-hosted Renovate, runs from whuppi/ci, scans consumer repos via RENOVATE_REPOSITORIES. SHA-pinned action + renovate 43.279.0. workflow_dispatch only + dry-run default, environment: renovate for the token. Pointed at whuppi/pdf_manipulator first.
• deploy/.deploy/secrets.sh — accepts a renovate env and auto-creates the GitHub environment (idempotent PUT), so RENOVATE_TOKEN is managed the same Bitwarden-backed way as RELEASE_TOKEN. secrets.json.example documents it.

Why: dependabot never scans composite action.yml (#6704); Renovate does. It keeps every whuppi/ci ref uniform (workflow + composite) and bumps third-party actions frozen in composites — we already hit actions/cache@v5.0.5 (a major behind, never bumped).

Token is already stored on the renovate env (Contents + Workflows + PRs + Issues: write, all whuppi repos).

After merge: dispatch → dryRun=full → read the log (should extract actions/cache from the composites, whuppi/ci refs uniformly, pub, fvmrc, no PRs opened). Then merge pdf#186 (config), flip dryRun=live, enable the schedule, widen the repo list, remove dependabot.

No CHANGELOG entry — internal workflow, not a consumed artifact, so no release.

[slopfairy]

Tip

Approved — the switch to workflow_call resolves both prior issues cleanly

Since the last review the design pivoted from workflow_dispatch to workflow_call with a boolean dryRun input. The ternary is now correct (true && 'full' || '' → 'full', false && 'full' || '' → ''), and without a checkout step there is no persist-credentials surface. The workflow is tight.

🟡 Suggestions — optional, take it or leave it

1. deploy/.deploy/secrets.sh:243 — upload_env does not handle the org env case (see inline). If someone runs ./secrets.sh upload org, it would create a repo environment literally called "org" and push secrets there instead of to the org level. Either add org support in upload_env or reject org in cmd_upload with a clear message.

✅ Checked

• workflow_call with dryRun: true default — safe default, callers opt into live
• No checkout step — the Renovate action clones via the PAT; no GITHUB_TOKEN in git config
• permissions: {} at top level, job-scoped contents: write / pull-requests: write / issues: write are explicit
• Action pinned to full SHA (3064367...) with version comment, renovate-version pinned to 43.279.0
• github.repository used in RENOVATE_REPOSITORIES — generic, never hardcoded
• secrets.sh org handling in cmd_set and cmd_rm uses correct --org / --visibility all flags
• secrets.json.example updated consistently

Note: the PR body still describes the old workflow_dispatch design — worth updating before merge so it matches what ships.