[Process] No Dependabot or Renovate — GitHub Actions and package ecosystems are not auto-updated

## Summary

There is no `.github/dependabot.yml` and no Renovate config in this repository. GitHub Actions (`actions/checkout@v4`, `azure/login@v2`, `docker/build-push-action@v6`, etc.) and language ecosystems are not receiving automated update PRs.

## Verified evidence (2026-09-08 audit)

```
ls .github/dependabot.yml .github/renovate.json renovate.json
# all missing
```

CD logs also warn that Node 20 Actions are deprecated and runners are forcing Node 24 (`azure/login@v2`).

## Impact

- Stale Actions/SDKs accumulate until something breaks in CI/CD
- No SBOM-adjacent supply-chain process (also related to #739)

## Suggested fix

Add Dependabot (or Renovate) for at least:

- `github-actions`
- `nuget`
- `npm` (Dashboard, Chat ClientApp, VS Code, M365, `packages/ato-shared`)

Start by reviewing the existing GitHub Actions under .github and the repository's NuGet and npm package locations. Add either .github/dependabot.yml or a Renovate configuration covering github-actions, nuget, and npm; done means the chosen configuration is present and specifies update coverage for the listed ecosystems.

Written by the indexing model from the issue text.