chore(deps): update dependency @types/jest to v30 - #560

19 dependency PRs were open, the oldest from **February 2025**. This is
not a backlog anyone neglected — the automation was *structurally
incapable* of merging any of them, for three independent reasons, none
of which produces a visible failure anywhere.

## Why nothing merged

| # | Mechanism | Fault |
| --- | --- | --- |
| 1 | `.github/mergify.yml` (extends `unional/.github`) | every rule
ends in `merge: { method: rebase }`. This repo has `allow_rebase_merge:
false` — merge commits only. Mergify asks for a method the repo refuses
and the PR sits `CLEAN` forever. |
| 2 | the same file's Renovate rule | gates on `label=safe-update`.
Nothing applies that label: `.github/renovate.json` extended
`github>unional/renovate-preset`, which is two lines (`config:base` +
`:preserveSemverRanges`) and sets no labels. |
| 3 | `.github/workflows/automerge-dependabot.yml` | `gh pr merge --auto
--rebase` — fails for reason 1 too. |

Reasons 1 and 2 are independent: fixing either alone still merges
nothing.

## One updater, one merge mechanism

**Renovate**, with **GitHub-native auto-merge**. `platformAutomerge:
true` arms GitHub's own auto-merge, which *feeds* the merge queue
instead of bypassing it the way a bot's own `merge` action does.

`.github/renovate.json` now carries the config directly rather than
extending the two-line preset:

- minor / patch / pin / digest, and **all** devDependency updates →
automerge.
- majors of anything a consumer resolves → manual, under a `major-`
branch prefix.
- `minimumReleaseAge: "3 days"` mirrors the 24h npm soak in `.npmrc` at
the PR level, so Renovate does not open a PR for a package that just
landed. `vulnerabilityAlerts` drops that to 1 day and automerges.
- `ignorePaths` adds `old/**`. Renovate had been filing PRs against
`old/checker`, which is not a pnpm workspace member, is not installed,
and is now `private`. #560 (`@types/jest` v30) was one of those.
- **`ts-5.4` / `ts-5.5` disabled.** They are npm aliases pinning those
exact TypeScript minors so `test:type` proves the emitted declarations
still compile on the oldest supported compilers. Bumping them to
`~5.9.0` deletes the matrix. #530 and #531 had been asking to do
precisely that since February 2025.

`.github/mergify.yml` and the Dependabot automerge workflow are deleted.
Dependabot's version updates are retired in favour of Renovate — the two
were filing the same bump twice (#624 and #625 are both `vitest` 4.1.0).

## Incidental fix

`@size-limit/esbuild-why` had been automerged to `^12.0.0` while
`size-limit` and `@size-limit/preset-small-lib` stayed on `^11.1.5` — a
plugin a full major ahead of the host it plugs into. All three now on
`^13.0.3`.

## Release impact

**None. No changeset.** Nothing here reaches the published artifact: CI
config, lint-time tooling, and a devDependency.

`pnpm verify` green locally: 7/7 turbo tasks, including `size` on
size-limit 13.