ci(renovate): coverage is inconsistent and unwatched repositories have stale toolchains

[ss-o]

Problem

Renovate coverage is inconsistent across the organization, and the repositories it does not watch have visibly rotted.

Surveying .github/renovate.json:

Repository	Preset
.github, zi, src, wiki, F-Sy-H	local>z-shell/.github:renovate-config
zsh-string-lib	config:base, deprecated and not the org preset (fixed in z-shell/zsh-string-lib#13)
fzf, zsh, zpmod	no .github/renovate.json at all

The effect is measurable in the pinned trunk toolchains:

Repository	trunk CLI	prettier	markdownlint
.github	1.25.0	3.8.3	0.48.0
F-Sy-H	1.25.0	3.9.6	0.49.1
zi	1.25.0	3.6.2	0.45.0
zsh-string-lib (before #13)	1.3.1	2.8.3	0.33.0
fzf	1.0.1	2.7.1	0.32.2
zsh	0.14.1-beta	2.7.1	0.31.1

This is not only about being behind. prettier 2.8.3 predates GitHub alert syntax and silently folds a > [!NOTE] marker onto the following line, so the callout stops rendering. Any repository still on it will quietly mangle that syntax in documentation.

runbooks/dependency-management.md assigns routine version updates to Renovate, so a repository outside its coverage has no owner for this work at all.

Proposed change

Decide which repositories Renovate should watch, then give each one the shared preset. The package repositories are the open question: there are roughly twenty of them, they are mostly manifests and documentation, and it is reasonable to argue they need less attention than the core repositories. What is not reasonable is the current state, where the answer differs per repository by accident rather than by decision.

Acceptance

• A recorded decision on which repository classes Renovate watches.
• Every repository in those classes extends local>z-shell/.github:renovate-config.
• No repository still extends the deprecated config:base.
• Repositories deliberately excluded are listed somewhere, so the absence reads as a choice.

Context

Found while refreshing zsh-string-lib's toolchain by hand in z-shell/zsh-string-lib#13, after its prettier version mangled a GitHub alert during unrelated work.