add renovatebot

[joshuafernandes]

PR Description

add renovatebot

---

Note

Medium Risk
Introduces automated dependency update tooling in CI, including a GitHub Actions workflow that runs with app credentials from secrets; misconfiguration could create noisy PRs or expose update automation issues.

Overview
Adds RenovateBot automation via a new GitHub Actions workflow (.github/workflows/renovatebot.yml) that runs on master workflow changes or manual dispatch and executes ConsenSys/github-actions/renovatebot using GitHub App secrets.

Introduces renovate.json extending config:recommended, disables the dependency dashboard, and configures package rules to pin GitHub Action digests (with trusted-action matching for actions/** and consensys/github-actions/**).

^{Written by Cursor Bugbot for commit daee97b. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

[cursor]

Rule 2 is redundant — missing enabled restriction

Medium Severity

Rule 2 describes "For trusted actions, allow updates" implying untrusted actions should only get digest pinning without version updates. However, with config:recommended, updates are enabled for all dependencies by default. Rule 1 adds pinDigests: true for all GitHub Actions, and rule 2 adds the same pinDigests: true for a subset — making it completely redundant. To match the stated intent, rule 1 likely needs "enabled": false so that only the trusted actions in rule 2 receive version update PRs.