ci: add renovate auto-approve workflow

[jimisola]

Summary

• Add caller workflow for the centralised Renovate auto-approve reusable workflow in reqstool/.github
• When Renovate opens a PR, this workflow approves it using `GITHUB_TOKEN`, satisfying the required-review branch protection rule
• Unblocks Renovate's existing auto-merge setting so PRs merge automatically once checks pass

🤖 Generated with Claude Code

To fix the issue, add an explicit permissions block that grants the least privileges needed for this workflow. Since this workflow simply triggers a reusable workflow on pull_request events and does not itself perform any repository modifications, a safe and minimal default is to restrict GITHUB_TOKEN to read-only access to repository contents.

The best targeted fix without changing existing functionality is to add a top-level permissions: section (applies to all jobs) or a job-level permissions: under jobs.approve. Both satisfy CodeQL; using a top-level block is clearer and future-proof if additional jobs are added. We’ll add:

permissions:
  contents: read

between the on: block and the jobs: block in .github/workflows/renovate-approve.yml. This documents that the workflow only needs read access to repository contents and ensures the token is not granted unnecessary write privileges. No imports or additional definitions are required.