SRE-800: Auto-bump hashintel/.github workflow pins

[claude]

Requested via Slack thread

Closes SRE-800

Before

After a merge to hashintel/.github, every consuming repo's "🚀 Dependency Updates" dashboard holds the reusable-workflow digest bump (branch deps/gha/hashintel-.github-digest, dep hashintel/.github) under Pending Approval until someone ticks the checkbox in each repo — as happened with #76 on 2026-07-11, when zero bump PRs appeared until the boxes were ticked manually. The global dependencyDashboardApproval: true in this shared preset gates them, and the github-actions rule's "schedule": ["before 2am on saturday"] plus the global minimumReleaseAge: "14 days" would delay them further even once approved.

After

Renovate opens the bump PRs in all consuming repos on its next 2-hourly run with no approval step, and the existing global automerge: true (+ automergeSchedule) takes them in once CI is green.

How

Adds a packageRule to renovate-config.json — the shared preset every hashintel repo extends via github>hashintel/.github:renovate-config, so this applies org-wide:

{
  "description": "Automatically bump the org's own reusable-workflow pins without dashboard approval",
  "matchManagers": ["github-actions"],
  "matchPackageNames": ["hashintel/.github"],
  "matchUpdateTypes": ["digest"],
  "dependencyDashboardApproval": false,
  "minimumReleaseAge": "0 days",
  "schedule": ["at any time"]
}

• Placement: immediately after the existing github-actions rule — Renovate merges packageRules in order, so the later rule overrides that rule's Saturday-only schedule for these pins while inheriting its commitMessageTopic, branch prefix, and assignees.
• Scope: matchUpdateTypes: ["digest"] limits the override to the SHA-pin bumps of our own reusable workflows; ordinary third-party action updates keep the existing approval + Saturday schedule.
• Schedule: "at any time" so bumps go out on the next Renovate run after a merge here rather than waiting for Saturday; minimumReleaseAge: "0 days" explicitly defeats the global 14-day cooldown.

npx renovate-config-validator (renovate 43.243.2, the version pinned in this repo): "Config validated successfully against 1 file(s)".