Sync main: disable Renovate here + pending fixes

[TheEndless]

What's included

An out-of-cycle sync (ahead of the next tagged release) to land three fixes:

• Renovate is now disabled in this repo. renovate.json sets enabled: false.
  This repo's required-review branch protection blocks Renovate's automerge, so
  every PR it opened here sat permanently blocked. Dependency updates will arrive
  already-applied through the normal sync process going forward. The 5 blocked
  Renovate PRs open on this repo were closed as redundant.
• Dependency bumps: electron 42.5.2 -> 42.7.0, js-yaml 5.2.0 -> 5.2.1,
  @codemirror/state 6.7.0 -> 6.7.1, @codemirror/view 6.43.4 -> 6.43.6, plus a
  GitHub Actions pin-to-exact-version/SHA cleanup in .github/workflows/docs.yml.
• A friendlier update-check error message replaces the raw HTTP dump when the
  update check fails.

All changes were verified with the full typecheck/lint/test gate and the Electron
end-to-end suite before this sync.