ci: skip the review on Renovate PRs and use the shared Renovate preset

[BrianEstrada]

Why

Renovate pushes its branches to this repo, so its PRs ran review.yml with the Claude secrets in the environment while running diffcop with the PR's updated dependencies. A hijacked npm release could read them.

Approach

• review.yml skips PRs opened by renovate[bot], next to the existing fork check. It checks the PR's author, not the pusher, so it holds on every push to a Renovate branch.
• .github/renovate.json now extends the shared github>BrianEstrada/.github preset. It's this repo's old config (config:recommended, chore commits, pinned action digests) plus a 3-day minimumReleaseAge for npm releases, so a bad version is likely pulled before Renovate proposes it.

Verification

• actionlint passes.
• renovate-config-validator --strict passes on the shared preset.

[github-actions]

diffcop review

✅ All good

What we looked at

I read the workflow and the diff. The author-based skip condition is valid and holds on every push to a Renovate branch. I could not read the external shared Renovate preset, so I could not check the description's claims about it.

Read (1): .github/workflows/review.yml

Searched (1): .github/**

---

_{Reviewed e060a5a · 14s · 2 tool calls · 19.1K input tokens (76% cached) · 847 output · ~$0.03 run}