chore(renovate): enable auto-merge for dependency updates

[kriszyp]

Summary

• Adds "automerge": true at the top level of renovate.json so Renovate will automatically merge PRs once CI passes

🤖 Generated with Claude Code

[claude]

Top-level automerge: true applies to major version bumps too.

None of the existing packageRules adds "automerge": false for major updates, so a major dependency release will be merged automatically once CI passes and the 7-day age window clears — no human review required.

For a core infrastructure package this is a meaningful supply chain exposure: a compromised or breaking major release gets merged without any maintainer eyes on it. Minor/patch automerge is generally fine given the minimumReleaseAge+internalChecksFilter guards, but major updates typically warrant human sign-off.

Suggested change

	"automerge": true,
	"automerge": true,
	"major": { "automerge": false },

Or equivalently as a packageRules entry:

{ "matchUpdateTypes": ["major"], "automerge": false }

[claude]

1 finding.

1. automerge: true applies to major version updates

File: renovate.json:10
What: The top-level automerge: true has no matching packageRule that sets automerge: false for matchUpdateTypes: ["major"], so major dependency bumps will be merged automatically once CI passes.
Why it matters: CI passing on a major update doesn't guarantee the dependency is safe or non-breaking. For a core infrastructure package, an auto-merged compromised or breaking major release can cascade to all downstream consumers without any maintainer review.
Suggested fix: Add "major": { "automerge": false } (or an equivalent packageRules entry) to restrict auto-merge to minor/patch updates only.

[Ethan-Arrowood]

Major or otherwise I think this is reasonable. If 7-day age + CI passes, ship it. If something breaks, we'll find out and then can fix.