feat: add Renovate automation for OpenShell version pin

[maruiz93]

Summary

• Add renovate.json with a regex custom manager that tracks OPENSHELL_VERSION in the composite action and opens PRs when new NVIDIA/OpenShell tags are published (no auto-merge)
• Enable Renovate's git-submodules manager to replace Dependabot for submodule tracking
• Remove .github/dependabot.yml (consolidated onto Renovate)

Note: The Renovate regex intentionally tracks only the OPENSHELL_VERSION env var, not the install script URL (still pinned to v0.0.36). The install script must be migrated to the new package-based installer before bumping past v0.0.36 — see #878.

Closes #773

Test plan

• Verify renovate.json passes Renovate config validator
• Install the Renovate GitHub App on the fullsend-ai org or repo — the config has no effect without it
• After Renovate is enabled, confirm it detects OPENSHELL_VERSION=v0.0.36 and opens a version bump PR when a new OpenShell tag is published
• Confirm git submodule update PRs are created by Renovate (replacing Dependabot)

🤖 Generated with Claude Code

[github-actions]

fullsend review is working on this — view logs

[github-actions]

Site preview

Preview: https://c5b1436a-site.fullsend-ai.workers.dev

Commit: fcf5312b9a350e434d8e1d9201a487cecb264761

[fullsend-ai-review]

Review: #882

Head SHA: fcf5312
Timestamp: 2026-05-13T00:00:00Z
Outcome: approve

Summary

Clean, well-scoped change that adds a Renovate configuration to automate OpenShell version tracking and consolidates dependency management by removing Dependabot. The regex custom manager correctly matches the OPENSHELL_VERSION=v<semver> pattern in the composite action file while intentionally leaving the install script URL untracked (migration tracked in #878). The git-submodules manager replaces the equivalent Dependabot functionality. No auto-merge is configured, matching the requirement from #773 that PRs require e2e validation before merge. No findings across any of the six review dimensions.

Findings

No findings.

Footer

Outcome: approve
This review applies to SHA fcf5312b9a350e434d8e1d9201a487cecb264761. Any push to the PR head clears this review and requires a new evaluation.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• .github/dependabot.yml

[rh-hemartin]

I'm not sure how e2e tests work in regard to changes in the workflows now that we have reusable ones, we need to make sure these are tested before merging.