ci: add renovate auto-approve workflow

[jimisola]

Summary

• Add caller workflow for the centralised Renovate auto-approve reusable workflow in reqstool/.github
• When Renovate opens a PR, this workflow approves it using `GITHUB_TOKEN`, satisfying the required-review branch protection rule
• Unblocks Renovate's existing auto-merge setting so PRs merge automatically once checks pass

🤖 Generated with Claude Code

In general, the fix is to explicitly define a permissions: block either at the workflow root (applies to all jobs) or inside the specific job. Since this workflow only defines a single job (approve) that simply calls a reusable workflow, the cleanest approach is to add a root-level permissions: section that grants only read access to repository contents, which is usually sufficient for Renovate approval logic driven by another workflow. If the reusable workflow needs additional scopes, they can be added there; here we keep the caller minimal.

Concretely, in .github/workflows/renovate-approve.yml, insert a permissions: block after the name: line and before on:. Use a minimal least-privilege setting such as:

permissions:
  contents: read

This ensures the GITHUB_TOKEN used by this workflow is explicitly limited and no longer depends on potentially broad repository defaults. No imports or additional methods are needed; only the YAML structure changes.