Renovate for all repos, with a shared preset

Renovate ran from the iac repo for iac only. Run it from here for every
repo that should get version bump PRs, with the rules they share in
default.json (local>asxpi/renovate): bundler held at nixpkgs' 2.7.2,
Postgres majors flagged as migrations, action bumps grouped.

Repos without a renovate.json get an onboarding PR first, so nothing
changes in a repo until its config is merged.

Assisted-by: Claude:opus-5-5

README.md

@@ -0,0 +1,18 @@
+# renovate
+
+Runs [Renovate](https://docs.renovatebot.com/) daily (05:17 UTC) for the
+repos in `.forgejo/workflows/renovate.yaml`, as the `renovate-bot` user:
+one PR per version bump, with release notes.
+
+- **Adding a repo:** add it to `RENOVATE_REPOSITORIES` and give
+  `renovate-bot` Write access. Its first PR is "Configure Renovate",
+  which adds a `renovate.json` extending this repo's preset; merge it
+  to start getting bumps.
+- **Shared rules:** `default.json`, used as `local>asxpi/renovate`:
+  `deps:` commit prefix, no dependency dashboard, bundler pinned to
+  2.7.2 (nixpkgs' version), Postgres majors flagged as migrations,
+  action bumps grouped, Renovate itself monthly.
+- **Secrets:** `RENOVATE_TOKEN` (renovate-bot's token) and
+  `GH_COM_TOKEN` (read-only github.com token for release notes).
+- **Run now:** Actions → renovate → Run workflow, or
+  `fj -H git.asxp.io actions dispatch -r asxpi/renovate renovate.yaml main`.