ci: consolidate dependency automation on Renovate (#631)

19 dependency PRs were open, the oldest from **February 2025**. This is
not a backlog anyone neglected — the automation was *structurally
incapable* of merging any of them, for three independent reasons, none
of which produces a visible failure anywhere.

## Why nothing merged

| # | Mechanism | Fault |
| --- | --- | --- |
| 1 | `.github/mergify.yml` (extends `unional/.github`) | every rule
ends in `merge: { method: rebase }`. This repo has `allow_rebase_merge:
false` — merge commits only. Mergify asks for a method the repo refuses
and the PR sits `CLEAN` forever. |
| 2 | the same file's Renovate rule | gates on `label=safe-update`.
Nothing applies that label: `.github/renovate.json` extended
`github>unional/renovate-preset`, which is two lines (`config:base` +
`:preserveSemverRanges`) and sets no labels. |
| 3 | `.github/workflows/automerge-dependabot.yml` | `gh pr merge --auto
--rebase` — fails for reason 1 too. |

Reasons 1 and 2 are independent: fixing either alone still merges
nothing.

## One updater, one merge mechanism

**Renovate**, with **GitHub-native auto-merge**. `platformAutomerge:
true` arms GitHub's own auto-merge, which *feeds* the merge queue
instead of bypassing it the way a bot's own `merge` action does.

`.github/renovate.json` now carries the config directly rather than
extending the two-line preset:

- minor / patch / pin / digest, and **all** devDependency updates →
automerge.
- majors of anything a consumer resolves → manual, under a `major-`
branch prefix.
- `minimumReleaseAge: "3 days"` mirrors the 24h npm soak in `.npmrc` at
the PR level, so Renovate does not open a PR for a package that just
landed. `vulnerabilityAlerts` drops that to 1 day and automerges.
- `ignorePaths` adds `old/**`. Renovate had been filing PRs against
`old/checker`, which is not a pnpm workspace member, is not installed,
and is now `private`. #560 (`@types/jest` v30) was one of those.
- **`ts-5.4` / `ts-5.5` disabled.** They are npm aliases pinning those
exact TypeScript minors so `test:type` proves the emitted declarations
still compile on the oldest supported compilers. Bumping them to
`~5.9.0` deletes the matrix. #530 and #531 had been asking to do
precisely that since February 2025.

`.github/mergify.yml` and the Dependabot automerge workflow are deleted.
Dependabot's version updates are retired in favour of Renovate — the two
were filing the same bump twice (#624 and #625 are both `vitest` 4.1.0).

## Incidental fix

`@size-limit/esbuild-why` had been automerged to `^12.0.0` while
`size-limit` and `@size-limit/preset-small-lib` stayed on `^11.1.5` — a
plugin a full major ahead of the host it plugs into. All three now on
`^13.0.3`.

## Release impact

**None. No changeset.** Nothing here reaches the published artifact: CI
config, lint-time tooling, and a devDependency.

`pnpm verify` green locally: 7/7 turbo tasks, including `size` on
size-limit 13.

Author: unional

.github/mergify.yml

@@ -1,3 +1,39 @@
 {
-	"extends": ["github>unional/renovate-preset"]
+	"$schema": "https://docs.renovatebot.com/renovate-schema.json",
+	"extends": ["config:recommended", ":preserveSemverRanges", ":semanticCommits"],
+	"minimumReleaseAge": "3 days",
+	"platformAutomerge": true,
+	"rebaseWhen": "behind-base-branch",
+	"ignorePaths": ["**/node_modules/**", "old/**"],
+	"packageRules": [
+		{
+			"description": "Non-breaking updates merge themselves through the merge queue.",
+			"matchUpdateTypes": ["minor", "patch", "pin", "digest"],
+			"automerge": true
+		},
+		{
+			"description": "devDependencies never reach a consumer, so majors are safe to automerge too.",
+			"matchDepTypes": ["devDependencies"],
+			"automerge": true
+		},
+		{
+			"description": "Majors of anything a consumer resolves stay manual.",
+			"matchUpdateTypes": ["major"],
+			"automerge": false,
+			"additionalBranchPrefix": "major-"
+		},
+		{
+			"description": "`ts-5.4` and `ts-5.5` are npm aliases for those exact TypeScript minors. They exist so `test:type` proves the emitted types still compile on the oldest supported compilers. Bumping them defeats the entire point of the matrix.",
+			"matchPackageNames": ["ts-5.4", "ts-5.5"],
+			"enabled": false
+		}
+	],
+	"vulnerabilityAlerts": {
+		"minimumReleaseAge": "1 day",
+		"automerge": true
+	},
+	"lockFileMaintenance": {
+		"enabled": true,
+		"automerge": true
+	}
 }

.github/renovate.json

@@ -76,15 +76,15 @@
   },
   "devDependencies": {
     "@repobuddy/typescript": "^2.0.0",
-    "@size-limit/esbuild-why": "^12.0.0",
-    "@size-limit/preset-small-lib": "^11.1.5",
+    "@size-limit/esbuild-why": "^13.0.3",
+    "@size-limit/preset-small-lib": "^13.0.3",
     "@types/node": "^18.11.11",
     "@vitest/coverage-v8": "^4.0.15",
     "assertron": "^11.0.2",
     "cross-env": "^10.0.0",
     "npm-run-all2": "^8.0.0",
     "rimraf": "^6.0.0",
-    "size-limit": "^11.1.5",
+    "size-limit": "^13.0.3",
     "ts-5.4": "npm:typescript@~5.4.0",
     "ts-5.5": "npm:typescript@~5.5.0",
     "typescript": "catalog:",