Renovate resumes opening update PRs after the default-branch rename

## Summary

`renovate.json` still pins `baseBranchPatterns: ["master"]`, so Renovate skips this repository entirely and has opened no update PRs since the rename.

## Motivation

The dependency dashboard (#91) reports:

```
## Repository Problems

- ⚠️ WARN: Base branch does not exist - skipping
```

The default branch became `main` when #84 renamed it (closed 2026-07-18); `renovate.json` was not updated with it. The last Renovate PR merged here was 2026-06-20, so the repo has gone roughly five weeks with no dependency updates at all — including security ones, since a skipped repo is never looked at.

Auditing the whole fleet turned this up in `woodland-generators` as well.

## Scope

- Delete `baseBranchPatterns` from `renovate.json`. Renovate auto-detects the default branch; hard-coding it is what allowed this to break, and it buys nothing for a single-branch repo. Setting it to `["main"]` also works but leaves the same trap for the next rename.
- Piggyback, same file and same audit: this config sets `minimumReleaseAge: "3 days"` with no `packageRules` carve-out for update types that carry no release timestamp. `config:best-practices` pins action digests, and `internalChecksFilter` defaults to `strict`, so once Renovate runs again every `digest`, `pin`, `pinDigest` and `lockFileMaintenance` update will park on a `renovate/stability-days` check that can never resolve — silently, because no PR is opened. Add:

```json
{
"matchUpdateTypes": ["pin", "pinDigest", "digest", "lockFileMaintenance",
"lockfileUpdate", "rollback", "bump", "replacement"],
"minimumReleaseAge": null
}
```

- While in the file: `internalChecksFilter: "strict"` and `vulnerabilityAlerts.minimumReleaseAge` only restate Renovate's own defaults and can go.

## Acceptance criteria

- [ ] `renovate.json` has no `baseBranchPatterns`
- [ ] Dashboard #91 no longer reports a Repository Problem, and lists detected dependencies
- [ ] Renovate opens at least one update PR, confirming the repo is being processed
- [ ] The no-timestamp carve-out is present, so digest updates are not parked once processing resumes

## Additional context

The same rename is queued for `zfs-replicate` in alunduil/alunduil-infrastructure#214, whose `renovate.json` also pins `baseBranchPatterns: ["master"]` — it will break identically unless that field goes in the same change.