Add dependency update automation (Dependabot or Renovate)

## Recommendation

### 🔒 CRITICAL: Add Dependency Update Automation

No Dependabot or Renovate configuration found. Security patches for the 100+ npm dependencies won't be applied automatically.

The `.pinact.yaml` exists but only covers GitHub Actions SHA pinning, not npm/pnpm package updates.

## What Was Found

- No `.github/dependabot.yml`
- No `renovate.json` or `.renovaterc.json`
- `pnpm-lock.yaml` exists but dependencies may contain known vulnerabilities that go unpatched

## How to Fix

**Option A: Dependabot** (simpler)
```yaml
# .github/dependabot.yml
version: 2
updates:
- package-ecosystem: npm
directory: "/"
schedule:
interval: weekly
groups:
dev-dependencies:
dependency-type: development
production-dependencies:
dependency-type: production
- package-ecosystem: github-actions
directory: "/"
schedule:
interval: weekly
```

**Option B: Renovate** (more configurable, supports pnpm workspaces natively)

## Impact

Automated PRs for security patches and dependency updates across all workspace packages.

---
**Category:** Supply Chain Security | **Priority:** Critical | **Effort:** Small (~30 min)
Part of #11022
_Filed by repo-audit skill_

┆Issue is synchronized with this [Notion page](https://www.notion.so/Issue-11024-Add-dependency-update-automation-Dependabot-or-Renovate-33e6d73d365081179ac8d165299437f7) by [Unito](https://www.unito.io)