Enable Renovate automerge and Zizmor CI

[rb3ckers]

Use the shared Go, Docker and automerge presets with scheduled Renovate and approval App workflows.

Add a Zizmor CI check using the standard SHA-pinned action, fix the existing findings, and require the check directly through StackVista/pulumi-infra#413.

Uses the presets from StackVista/renovate-config#29. Merge and apply StackVista/pulumi-infra#413 first to provision both Apps’ variables and secrets; both Apps need repository access and the updater App needs Dependabot alerts read access. Keep Dependabot security updates disabled.

Tracking: https://github.com/StackVista/stackstate/issues/865

Validation: Renovate schema, Actionlint, authenticated Zizmor 1.31.1 and shell-input checks passed.

[LouisParkin]

Verdict: request changes (one gap, fix lands in pulumi-infra#413). Commits signed, action SHAs match their tag comments, persist-credentials: false/explicit permissions/env-indirection look right, cross-repo tracking link is correct, CI green on 5106739.

Medium — Specification ("blocking Zizmor CI check") / automerge safety: .github/workflows/ci.yml:128 — see inline.

Note: renovate.yml will fail on schedule until StackVista/pulumi-infra#413 (still open) is applied; merge order as stated in the description.

[LouisParkin]

Medium: the Zizmor check doesn't block merges: it isn't a required check, so Renovate automerge could merge a PR where Zizmor failed and the tests were skipped. The fix goes in pulumi-infra#413.

Fixed and superseded by Louis' review

[LouisParkin]

Post-merge: Workflow security lint (Zizmor) is red on the default branch. ref-version-mismatch flags auto-approve-bot-prs.yml:23 and renovate.yml:13, whose c5f974f5… # main pins no longer match main since renovate-config moved. Re-pinning fixes it until the next renovate-config merge. The lasting fix is tagged renovate-config releases with # vX.Y.Z pins (see StackVista/stackstate-agent#547).

On this repo Zizmor is a required check, so every Renovate PR is blocked until this is fixed.