fix(renovate): the policy repo has no renovate.json, a stale golangci Dockerfile pin and an unpinned go-licenses

[krisarmstrong]

Defects (the policy repo does not apply its own pin policy; three items for one PR)

1. No renovate.json at the repo root: default.json is the preset other repos extend, but Renovate never runs against .github itself (gh pr list --author app/renovate --state all shows only the 2026-08-15 bootstrap PR). The reusable workflows have drifted from each other: license-check.yml:39 checkout v7.0.0 vs ci.yml:30 v7.0.1; license-check.yml:44 setup-go v6.5.0 vs ci-conformance.yml:55 v7.0.0; license-check.yml:50 setup-node v6.4.0 vs ci.yml:68 v7.0.0; semgrep.yml:34 setup-python v6.0.0 vs ci.yml:34 v7.0.0.
2. tools/lint-linux/Dockerfile:17 ARG GOLANGCI_VERSION=v2.13.1, one patch behind the fleet pin v2.13.2 (ci-conformance-schedule.yml:60). This image is the only Linux lint pass cgo-tagged files get; a rule added in v2.13.2 does not fire there. The GOLANGCI_LINT_VERSION := custom manager in default.json matches Makefile syntax only, so nothing would ever bump this line.
3. license-check.yml:57 go install github.com/google/go-licenses@latest is unpinned inside a fleet-shared reusable workflow, invisible to every consumer's check-ci-conformance.py unpinned_tools(), which globs only the calling repo's files; the same file's node_version default is 26.4.0 against the fleet's 26.8.1.

Fix

Add a self-referential renovate.json; bump the Dockerfile ARG and add a custom manager for ARG GOLANGCI_VERSION=; pin go-licenses to an exact version tracked by the existing go install manager; bump the Node default.

Acceptance

A Renovate PR or dashboard appears on .github within a day; rg GOLANGCI_VERSION tools/lint-linux/Dockerfile shows v2.13.2; rg '@latest' .github/workflows/*.yml is empty.

Found by the 2026-09-15 fleet defect sweep (msn-plans msn-defect-sweep-2026-09-15.md).