ci(renovate): group @connectrpc/* so the exact peer moves as one PR

[krisarmstrong]

Summary

Adds a @connectrpc/** group rule to the fleet Renovate preset so
@connectrpc/connect and @connectrpc/connect-web move as one PR.

@connectrpc/connect-web declares an exact peer on @connectrpc/connect
(2.2.0 requires exactly 2.2.0), so a PR bumping either half alone cannot
regenerate the lockfile: it is born red on renovate/artifacts and no rebase
fixes it. Two such PRs are open on trellis right now (#428 since 2026-09-10,
#447 since 2026-09-14), both red, both consuming the repo's two-open-PR cap.

This is the same failure shape as @vitest/**, already grouped with vitest
in this file for exactly this reason; the new rule's description records the
cause so the next reader does not have to rediscover it.

Renovate closes #428 and #447 on its next tick and raises one grouped PR in
their place — they are not expected to self-heal.

Linked Issue

Fixes #63

Type of Change

• CI / tooling configuration

Risk

Low, and confined to how Renovate batches npm PRs. The rule only adds a
groupName; it changes no version, no automerge policy (the existing
patch/minor automerge rule still applies to the group) and no other package.
@bufbuild/protobuf is deliberately not in the group — its peer is a
caret range (^2.7.0), so it resolves independently and does not need to move
in lockstep.

Testing Evidence

The peer that causes the failure:

$ npm view @connectrpc/connect-web@2.2.0 peerDependencies --json
[
  {
    "@bufbuild/protobuf": "^2.7.0",
    "@connectrpc/connect": "2.2.0"
  }
]

The validator CI runs (ci.yml:76), on this branch:

$ npx --yes --package renovate@42.5.2 -- renovate-config-validator default.json
 INFO: Validating default.json
 WARN: Config migration necessary
...
             "description": "Connect RPC packages move as one PR. ...",
             "matchManagers": ["npm"],
             "matchPackageNames": ["@connectrpc/**"],
             "groupName": "connectrpc"
...
 INFO: Config validated successfully

The WARN: Config migration necessary is pre-existing and untouched by this
change — the same validator on origin/main's copy of the file:

$ git show origin/main:default.json > base-default.json
$ npx --yes --package renovate@42.5.2 -- renovate-config-validator base-default.json
 INFO: Validating base-default.json
 WARN: Config migration necessary
 INFO: Config validated successfully

(It is the fileMatch → managerFilePatterns rename in the two customType: regex managers, out of scope here.)

JSON well-formedness:

$ python3 -c "import json;json.load(open('default.json'));print('json ok')"
json ok

Security and Release Checklist

• No secrets, credentials or tokens added
• No workflow permissions changed (default.json only; no .github/workflows file touched)
• No new dependency introduced
• Change is reversible by reverting one commit