Renovate automerges the update classes that do not need a human read

## Summary

Turn on automerge in `renovate.json` for pre-commit hooks, GitHub Actions digests and pins, and the development dependency groups, at patch and minor.

## Current behaviour

`renovate.json` sets no `automerge`, so every update waits for a manual merge. #682, a `ruff-pre-commit` patch, is green on all sixteen checks and its body reads "Automerge: Disabled by config". The stale sweep in `daily.yml` exempts the `dependencies` label, so these accumulate rather than age out.

## Motivation

Renovate raises more updates than get read, and the classes it raises for pre-commit hooks, Actions digests, and development dependencies carry no runtime risk to users of the published package.

alunduil/alunduil-infrastructure#444 supplies the two things automerge needs before it is safe: required checks that cover the test suite, and a review rule Renovate can bypass without bypassing those checks. Without both, automerge would land changes on the strength of the PR-title check alone.

## Approach and alternatives

- `packageRules` with `automerge: true` for `matchManagers: ["pre-commit"]`; for `matchManagers: ["github-actions"]` at `digest`, `pin`, `pinDigest`, `minor`, and `patch`; and for the `mutation` and `test` depTypes at `minor` and `patch`.
- Runtime dependencies and every major update stay manual.
- `automergeStrategy: "squash"`, since the repository allows no other merge method.
- Leave `platformAutomerge` at its default, so GitHub performs the merge and weighs only the required checks. Renovate merging on its own waits for every check to be green, which the experimental `3.x` legs can stall.
- `minimumReleaseAge: "3 days"` already applies and does not change. Automerge does not shorten the supply-chain bake, and `internalChecksFilter` keeps the stability check gating the branch.
- Worth knowing before it surprises someone: with automerge enabled, `rebaseWhen: "auto"` starts rebasing branches that are behind the base rather than only conflicted ones.

## Scope

`renovate.json`

## Out of scope

Automerge for runtime dependencies and for majors. Grouping and scheduling (#399). The ruleset and repository settings, which live in alunduil/alunduil-infrastructure#444.

## Acceptance criteria

- [ ] Pre-commit hook, Actions digest and pin, and development-group patch and minor updates merge on their own once the gate is green
- [ ] Runtime dependency updates and all majors still wait for a manual merge
- [ ] One Renovate pull request is observed merging on its own, and its squashed commit message validates as a Conventional Commit
- [ ] If GitHub auto-merge does not fire for a bypassing app, `platformAutomerge: false` is set instead and the finding is recorded here

## Related issues

- alunduil/alunduil-infrastructure#444 makes the required checks cover the suite and exempts Renovate from review. This merges on the PR-title check alone without it.
- #700 supplies the gate context that alunduil/alunduil-infrastructure#444 pins.

Start by reading renovate.json and the acceptance criteria, then check alunduil/alunduil-infrastructure#444 and #700 for the required gate context. Configure only the named pre-commit, GitHub Actions, and development-group patch/minor updates for automerge; confirm runtime and major updates remain manual, then observe a Renovate pull request merging with the required checks and a valid squashed Conventional Commit.

Escrito por el modelo de indexación a partir del texto del issue.