chore(deps): add Renovate config with ecosystem grouping and automerge

Adds .github/renovate.json extending config:base,
helpers:pinGitHubActionDigests, :separateMajorReleases, :automergeMinor,
and :automergePatch. Groups Sentry, OpenTelemetry, tRPC, Payload, and
Inversify into weekly per-cluster PRs to reduce noise. Enables Dockerfile
manager for .sandcastle/Dockerfile. Sets dependencyDashboard:true for a
single Renovate-managed tracking issue. Uses chore(deps): / chore(deps-major):
commit prefixes so release-please bump rules apply cleanly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/renovate.json

@@ -0,0 +1,52 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:base",
+    "helpers:pinGitHubActionDigests",
+    ":separateMajorReleases",
+    ":automergeMinor",
+    ":automergePatch"
+  ],
+  "dependencyDashboard": true,
+  "dependencyDashboardLabels": ["renovate/dashboard"],
+  "commitMessagePrefix": "chore(deps):",
+  "major": {
+    "commitMessagePrefix": "chore(deps-major):"
+  },
+  "packageRules": [
+    {
+      "groupName": "Sentry packages",
+      "matchPackagePatterns": ["^@sentry/"],
+      "schedule": ["on monday"],
+      "automerge": false
+    },
+    {
+      "groupName": "OpenTelemetry packages",
+      "matchPackagePatterns": ["^@opentelemetry/"],
+      "schedule": ["on monday"],
+      "automerge": false
+    },
+    {
+      "groupName": "tRPC packages",
+      "matchPackagePatterns": ["^@trpc/"],
+      "schedule": ["on monday"],
+      "automerge": false
+    },
+    {
+      "groupName": "Payload packages",
+      "matchPackagePatterns": ["^payload"],
+      "schedule": ["on monday"],
+      "automerge": false
+    },
+    {
+      "groupName": "Inversify packages",
+      "matchPackagePatterns": ["^inversify"],
+      "schedule": ["on monday"],
+      "automerge": false
+    }
+  ],
+  "dockerfile": {
+    "enabled": true,
+    "fileMatch": ["^\\.sandcastle/Dockerfile$"]
+  }
+}