chore: adopt shared conf-renovate preset (v1.2.1)

[gofreight-jackyeh]

Summary

Switches this repo onto the org-shared Renovate preset hardcoretech/conf-renovate pinned at v1.2.1. Part of the fleet rollout following the pilots gf-admin-console#182 (merged) and svc-thor#160.

No prior Renovate config existed; the new file is the minimum-form baseline:

{
  $schema: "https://docs.renovatebot.com/renovate-schema.json",
  extends: [
    "github>hardcoretech/conf-renovate#v1.2.1",
    ":preserveSemverRanges",
  ],
  labels: ["dependencies"],
}

What the preset provides (inherited baseline)

• config:best-practices + dependency dashboard.
• SHA-pin GHA + 3-day release-age soak + OSV alerts (locked).
• Per-ecosystem PR grouping with major-update isolation.
• Datastore version pinning (mysql / rabbitmq / valkey on docker+helm).
• Built-in self-bump customManager — the next preset release auto-PRs a bump of #v1.2.1 here without any local config.

Validation gate

A standalone .github/workflows/validate-renovate.yml runs renovate-config-validator --strict --no-global on PR + push. ~20 lines, triggers only on renovate.json5 / workflow changes. (No pre-commit infrastructure in this repo, so a standalone workflow is the lowest-overhead gate.)

Verification

• renovate-config-validator --strict --no-global renovate.json5 passes locally (Node 24 + renovate@43, LOG_LEVEL=warn, exit 0).
• After merge: Renovate dashboard onboards the new config cleanly.
• First scheduled run produces PRs under preset group names where applicable (e.g. gha-non-major).
• Next conf-renovate release auto-PRs a bump of #v1.2.1 → #v<next>.

Rollback

Revert this branch — the repo had no Renovate config before, so revert restores the prior (no-Renovate) state.