chore(deps): migrates renovate to centralized khepri-deps

.github/renovate.json

@@ -1,11 +1,5 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:best-practices",
-    ":semanticCommits"
-  ],
-  "gitAuthor": "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
-  "minimumReleaseAge": "14 days",
   "customManagers": [
     {
       "customType": "regex",
@@ -21,17 +15,5 @@
       "matchStrings": ["github:(?<depName>[\\w-]+/[\\w-]+)/(?<currentDigest>[a-f0-9]+).*#\\s*(?<currentValue>v[\\S]+)"],
       "datasourceTemplate": "github-releases"
     }
-  ],
-  "packageRules": [
-    {
-      "matchUpdateTypes": ["minor", "patch", "digest"],
-      "groupName": "non-major dependencies",
-      "groupSlug": "non-major"
-    },
-    {
-      "matchUpdateTypes": ["major"],
-      "groupName": "major dependencies",
-      "groupSlug": "major"
-    }
   ]
 }

template/.github/renovate.json.jinja

@@ -1,24 +1,7 @@
 {
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:best-practices",
-    ":semanticCommits"
-  ],
-  "gitAuthor": "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>",
-  "minimumReleaseAge": "14 days",
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json"{% if _is_template %},
   "customManagers": [
 {% include pathjoin("includes", "renovate-template.jinja") ignore missing %}
-  ],
-  "packageRules": [
-    {
-      "matchUpdateTypes": ["minor", "patch", "digest"],
-      "groupName": "non-major dependencies",
-      "groupSlug": "non-major"
-    },
-    {
-      "matchUpdateTypes": ["major"],
-      "groupName": "major dependencies",
-      "groupSlug": "major"
-    }
   ]
+{% endif %}
 }

tests/test_rendering.py

@@ -249,17 +249,11 @@ def test_pr_checks_pinned_actions(generated_github_project):
 
 
 def test_renovate_config_valid_json(generated_github_project):
-    """renovate.json is valid JSON with expected keys."""
+    """renovate.json is valid JSON with $schema (khepri-managed, minimal config)."""
     data = parse_json(generated_github_project / ".github" / "renovate.json")
-    assert "extends" in data
-    assert "customManagers" in data
-
-
-def test_renovate_no_template_config(generated_github_project):
-    """Default projects don't have template-specific Renovate managers."""
-    content = (generated_github_project / ".github" / "renovate.json").read_text()
-    assert "postUpgradeTasks" not in content
-    assert "template/" not in content
+    assert "$schema" in data
+    assert "extends" not in data
+    assert "customManagers" not in data
 
 
 def test_security_md(generated_github_project):