chore(deps): activate organization Renovate preset

[ss-o]

Summary

• activate the shared local>z-shell/.github:renovate-config preset from the default branch
• require Dependency Dashboard approval during Stage 1 so Renovate cannot open routine update PRs yet
• disable Renovate vulnerability-alert remediation so Dependabot retains security ownership
• preserve Renovate update PRs on next with baseBranchPatterns
• keep .github/dependabot.yml unchanged until live Renovate processing and GitHub security settings are verified

Safety boundary

This is Stage 1 of z-shell/.github#452. Do not approve any Dependency Dashboard update while this gate is active. Stage 2 will remove routine Dependabot configuration and the dashboard-approval gate atomically only after the tracker’s live-processing, security-settings, and zero-open-routine-Dependabot-PR gates pass.

Verification

• exact JSON structure: pass
• jq empty renovate.json: pass
• git diff --check: pass
• signed focused commit: pass
• Trunk Code Quality: pass
• reviews/comments/unresolved threads: none
• Renovate validator: official hosted validation branch renovate/reconfigure points at this exact head; pass/fail status pending

Draft until hosted Renovate validation and the remaining repository-security gates are satisfied.

Tracks: z-shell/.github#452

[ss-o]

Agent handoff — hosted Renovate validation is not arriving.

renovate/reconfigure points at this exact head, but there is still no Renovate status, dashboard, warning issue, or new bot PR. The only prior Renovate onboarding PR (#107) was closed unmerged; its onboarding text says that action disables Renovate.

Inference: Renovate is not currently processing this repository. Keep this PR draft and keep Dependabot unchanged. Resume after Renovate is re-enabled/re-onboarded (or a trusted local validator is explicitly authorized), then revalidate this head before merge.

Tracker detail: z-shell/.github#452