Catch up with the siblings, and set Renovate to watch them

[tannevaled]

Two halves of the same problem: this module was behind its own siblings, and nothing was watching.

WHAT IT WAS BEHIND ON

reader v0.6.0 carries fixes this module was doing without, including two denial
of service defects it was handing to its own callers:

a 219-byte file with no trailer, whose last object is numbered 2 147 483 647,
took 21.2 s to open and allocated not one byte — so no memory limit caught it;

/Crypt, which 209 files (12.8% of the 1 633 real government forms) carry and
which used to make every one of them decode to nothing readable;

a second map-order non-determinism, in indexObjectStreams, giving five
different answers in five runs of the same binary on the same file;

a damaged stream's decoded prefix kept and labelled as salvage, rather than
returned with a nil error as though it were the whole of it.

WHY IT HAPPENED, AND WHAT STOPS IT HAPPENING AGAIN

Nothing in this organisation was watching for a sibling's release. The org
already has a Renovate preset at go-pdfkit/.github, with rules for Go modules
and for actions — and not one of the ten Go modules extends it, so the preset
has never been read. This adds the one-line renovate.json that does, matching
what every go-ruby-* repository already has.

That is the durable half. Renovate still has to be installed on the
organisation for it to run, which this cannot do from here.