add renovatebot and codeowners

[joshuafernandes]

PR Description

add renovatebot

---

Note

Medium Risk
Mostly CI/configuration changes, but it alters GitHub Actions permissions and adds a Renovate workflow that runs with app credentials/secrets, so misconfiguration could impact repo automation and security posture.

Overview
Adds Renovate automation by introducing a scheduled/manual renovatebot GitHub Actions workflow plus renovate.json rules to manage updates for GitHub Actions, Gradle (deps + wrapper), and Dockerfiles (grouped PRs, 7-day minimum age, and action digest pinning).

Introduces CODEOWNERS for default ownership and explicit owners for .github/workflows/, and updates CI workflows to use least-privilege permissions (global read-all in ci.yml with explicit checks: write for test report jobs; removes unnecessary actions: write from cla.yml).

^{Reviewed by Cursor Bugbot for commit b0fba0f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[StefanBratanov]

What is the point of dependabot if we have renovateBot?

[joshuafernandes]

What is the point of dependabot if we have renovateBot?

I'd like to just use renovateBot for the lot but we've got Dependabot as part of GHAS - am waiting to hear from security if we can use one only. In the interim I've split by separation of concerns so renovate does the heavy lifting:

• Dependabot just alerts now on things,
• Renovatebot controls the GHA dependencies, gradle, pip etc - the minimumReleaseAge for stability is not available in dependabot

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0889a1a. Configure here.}

[rolfyone]

id really like to have reasoning when we're adding at the moment, our prs are very unstable with no visibility as to why, and im keen that it doesn't get even worse...

[joshuafernandes]

id really like to have reasoning when we're adding at the moment, our prs are very unstable with no visibility as to why, and im keen that it doesn't get even worse...

Which parts are unstable though?

[rolfyone]

tests fail and need re-running on basically every pr, we're investigating but have lost all the reporting

[gfukushima]

pr lgtm