Renovate merges its own patch updates once the suite is green

[ExtraToast]

Parent

#1289

What to build

Renovate opens grouped weekly pull requests with a seven-day cooldown and nothing merges them, so patch bumps queue for manual attention they rarely deserve. Automerge patch-level updates once every required check passes.

Cluster manifests stay excluded: that path already sets automerge: false, because a chart or controller image reaches production the moment it merges.

Neighbours #1277, which asks whether Dependabot is still enabled alongside Renovate.

Acceptance criteria

• Patch updates merge on their own once every required check passes
• Minor and major updates still require a human
• Nothing under the Flux tree automerges
• A failing check leaves the pull request open rather than merging it

Blocked by

None (can start immediately).