Extract the shared Renovate config into alunduil/renovate-config

## Summary

Factor the repo-invariant half of `renovate.json` into a shared preset repo (`alunduil/renovate-config`, a `default.json`) and have this repo extend it.

## Motivation

The hardening applied in #364 is byte-identical across the fleet: the `extends` list, `timezone`, `reviewers`, `pre-commit`, `minimumReleaseAge`, `osvVulnerabilityAlerts`, and the no-timestamp carve-out `packageRule`. Every repo that wants the bake period also wants the carve-out, and getting one without the other stalls updates silently. Keeping them inline means changing them everywhere at once, by hand, forever.

Dropping `baseBranchPatterns` in #364 removed the last blocker — it was the only field that differed per repo (`main` vs `master`). Renovate also checks `/renovate-config` automatically when onboarding a new repo, so the preset would apply to future repos without any config at all.

## Scope

- Create `alunduil/renovate-config` with a `default.json` holding the invariant block.
- Replace that block here with `"extends": ["github>alunduil/renovate-config"]`, keeping only what is genuinely repo-specific (the pnpm `customManagers` entry).
- Roll the same replacement through sibling repos.

Worth knowing before starting: `packageRules` and `customManagers` are `mergeable: true`, so a repo's own entries concatenate with the preset's rather than replacing them. `labels` and `reviewers` are not mergeable — setting either locally replaces the inherited value.

## Acceptance criteria

- [ ] `alunduil/renovate-config` exists with a `default.json`.
- [ ] This repo extends it and retains only repo-specific config.
- [ ] A Renovate run against this repo produces the same dependency set as before the extraction.

## Additional context

- #364 applied the block inline; this issue is the deduplication that work was shaped to allow.
- The `renovate-config-validator` hook added in #296 does not resolve remote presets, so it cannot catch a missing or changed `extends` target. That gap is worth noting in whatever this lands as.