Dependency updates arrive as grouped weekly Renovate PRs instead of per-mirror pings

## User story

As a **maintainer**, I want **dependency updates to arrive as a small number of grouped weekly PRs** so that **I stop spending review time on per-mirror autoupdate commits**.

## Why

Commits on `main` for the last year are dominated by `[pre-commit.ci] pre-commit autoupdate` merges — PRs #378 through #388. PR #389 (Renovate) is already open and will group updates by ecosystem (npm/pip/actions/docker/devcontainer) into a weekly Friday cadence with auto-label and reviewer routing. Keeping both bots running doubles the noise.

## Acceptance criteria

- [ ] Renovate PR #389 is merged after updating `renovate.json` `baseBranchPatterns` to only `["main"]` (post-rename).
- [ ] `.pre-commit-config.yaml` removes the `ci:` block OR sets `autoupdate_schedule: "never"` and `autofix_prs: false` remains. Local `pre-commit run` still works.
- [ ] Renovate is configured to group patch updates and auto-merge green patch bumps (`platformAutomerge: true`).
- [ ] Weekly cadence confirmed in `renovate.json`.

## Out of scope

- Adding Renovate for ecosystems Renovate doesn't already detect.

## Notes

- Target release: **none — chore**
- Depends on the branch-rename issue being merged first.
- Source: modernization assessment §4.