Renovate covers GitHub Actions updates alongside Python dependencies

## User story

As a **maintainer**, I want **Renovate to also watch GitHub Actions** so that **action pins stay current through the same grouped weekly PR cadence as Python dependencies, instead of needing manual catch-up every six months**.

## Why

The Renovate onboarding PR #389 detects `.github/workflows/*.yml` as `github-actions` manifests. Once Renovate is active and scoped to `main`, it covers actions automatically. The default `dependabot.yml` presently watches `pip` only; replacing Dependabot with Renovate (or simply adding the `github-actions` ecosystem to Dependabot) removes the gap.

## Acceptance criteria

- [ ] Post-Renovate-onboarding, `renovate.json` keeps `github-actions` grouping enabled (likely default via `config:recommended`).
- [ ] `.github/dependabot.yml` is deleted (Renovate covers everything) OR explicitly retained only for ecosystems Renovate does not handle — pick one and commit a short comment in `renovate.json` explaining why.
- [ ] Action pins are re-verified after the first Renovate run; any still-outdated pins get an issue filed.

## Out of scope

- Pinning actions by commit SHA (Scorecard covers surfacing that).

## Notes

- Target release: **none — chore**
- Depends on: Renovate onboarding PR merged, branch rename to `main`.
- Source: modernization assessment §4.