fix(renovate): align config with org standard — extend shared config, automerge digests

Dakota's renovate config was extending config:recommended instead of
the org's local>projectbluefin/renovate-config. It also didn't automerge
'digest' type updates (SHA pins are digest type), causing drift.

Changes:
- Extends local>projectbluefin/renovate-config (gets org rules)
- Adds digest to automerge matchUpdateTypes
- Adds projectbluefin/actions grouping rule (atomic SHA PRs)
- Preserves enabledManagers: github-actions (BST sources tracked separately)
- Preserves bonedigger exclusion

Resolves: projectbluefin/common#605

Assisted-by: Claude Sonnet 4 via pi
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: castrojo

.github/renovate.json5

@@ -1,25 +1,39 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:recommended",
+    "local>projectbluefin/renovate-config:org-inherited-config"
   ],
   // Renovate targets main. All PRs must target main — the CI gate
   // (on-pr-opened-or-updated) blocks any PR not targeting main.
   // Note: track-bst-sources.yml manages BuildStream refs directly and
   // intentionally targets main — it is not Renovate-managed.
   "baseBranchPatterns": ["main"],
   "branchPrefix": "renovate/",
-  "schedule": ["* 0-3 * * 1"],
 
   // Limit Renovate to GitHub Actions and workflow image refs.
   // BuildStream sources are tracked separately by track-bst-sources.yml.
   "enabledManagers": ["github-actions"],
 
-  // Do not rebase when the default branch is updated
-  "rebaseWhen": "never",
-
   "packageRules": [
     {
+      "description": "Automerge digest/pin/patch/minor when CI passes",
+      "matchUpdateTypes": ["digest", "pin", "patch", "minor"],
+      "automerge": true,
+      "automergeType": "pr",
+      "automergeStrategy": "squash"
+    },
+    {
+      "description": "Group all projectbluefin/actions SHA updates into one atomic PR",
+      "matchManagers": ["github-actions"],
+      "matchDepPatterns": ["projectbluefin/actions"],
+      "groupName": "projectbluefin/actions",
+      "automerge": true,
+      "automergeType": "pr",
+      "automergeStrategy": "squash",
+      "labels": ["chore/deps", "automerge"]
+    },
+    {
+      "description": "Pin all GitHub Actions to full SHA digests",
       "matchManagers": ["github-actions"],
       "matchDepTypes": ["action"],
       "pinDigests": true
@@ -29,12 +43,6 @@
       // See .github/workflows/bonedigger.yml and docs/skills/ci-tooling.md.
       "matchPackageNames": ["projectbluefin/bonedigger"],
       "enabled": false
-    },
-    {
-      "automerge": true,
-      "matchManagers": ["github-actions"],
-      "matchDepTypes": ["action"],
-      "matchUpdateTypes": ["minor", "patch"]
     }
   ]
 }