ci: switch from dependabot to renovate

[nielspardon]

Dependabot has no pixi support at all, so pixi.lock is never refreshed when a dependency PR changes pixi.toml. Because pixi validates the lock file against the manifest, such a PR leaves the repository in a state where the lock and the manifest disagree. Renovate handles this: it runs pixi lock as part of the update.

This mirrors substrait-io/substrait#1075, which makes the same switch for the spec repo and demonstrates the result end to end. Unlike that PR this one is config-only, with no self-hosted workflow: a Renovate maintainer has confirmed that Mend will add pixi to allowedUnsafeExecutions on the hosted Renovate App, so pixi.lock refreshes will start working here with no further change once that lands. Everything else Renovate manages works immediately.

• Adds renovate.json, porting the existing dependabot configuration.
• Removes .github/dependabot.yml to disable dependabot.

Requires #51 to land before the Renovate App is installed, so that a lock refresh cannot produce a v7 lock file that our pinned pixi cannot read.

How the dependabot configuration maps across

.github/dependabot.yml	renovate.json
github-actions group	matchManagers: ["github-actions"], groupName: github-actions
java-dependencies group (/java)	matchManagers: ["gradle", "gradle-wrapper"]
python-dependencies group (3 × /python/*)	matchManagers: ["pep621"]
rust-dependencies group (3 × /rust/*)	matchManagers: ["cargo"]
schemars ignore	matchPackageNames: ["schemars"], allowedVersions: "<0.9"
schedule: weekly (all)	Renovate's own scheduling; lockFileMaintenance runs weekly
— (dependabot has no pixi support)	matchManagers: ["pixi"], groupName: pixi-dependencies

Renovate needs no per-directory configuration, so the six dependabot entries collapse into one manager rule each. Verified locally with renovate --platform=local: cargo (3 files), github-actions (17), gradle (10), gradle-wrapper (1), pep621 (3) and pixi (1) all extract, 204 dependencies in total, and the expected groups appear as branches.

Two deliberate differences from a literal translation, both worth a look:

The schemars pin is tightened. Dependabot ignored version-update:semver-major for it, but schemars is at 0.8.22 and its major component is 0, so 0.9.0 counts as a minor update and dependabot would have proposed it. That contradicts the Cargo.toml comment, which says the pin has to stay on 0.8 to match the schemars version typify 0.7 uses, and Cargo itself treats a 0.x minor bump as breaking (Renovate reports isBreaking: true for it). allowedVersions: "<0.9" expresses the actual intent. With it, schemars reports no updates at all; without it, Renovate proposes 0.9.0.

:semanticCommitTypeAll(build) is required to keep the build(deps): prefix. config:recommended pulls in :semanticPrefixFixDepsChoreOthers, which contributes a rule assigning fix to dependencies whose depType is dependencies — 22 of ours, across cargo and gradle. Package rules override top-level config, so without this preset those PRs would arrive titled fix(deps): instead. There is no semantic-release in this repository, so this only affects titles.

Also worth noting: Renovate has no cmake manager, so the FetchContent dependencies in cpp/*/CMakeLists.txt stay unmanaged exactly as they are today. And the gradle-wrapper manager can only regenerate the wrapper scripts if Mend allows gradleWrapper in allowedUnsafeExecutions; the distributionUrl bump that actually upgrades Gradle lands either way.