ci: verify Renovate preset and Codecov OIDC

[edithatogo]

Outcome

Addresses the remaining external integration options from #224.

• inherits github>edithatogo/renovate-config
• retains Dependabot until a hosted Renovate run is proven
• uploads existing thresholded LCOV through pinned Codecov v5 using OIDC
• preserves the repository-owned coverage artifact and fail-closed thresholds
• adds integrity tests preventing premature fallback removal

Local evidence

• Renovate config validator: pass
• coverage thresholds: 77.66% lines / 83.33% functions / 65.42% branches
• lint/type/format: pass
• npm audit: 0 vulnerabilities

Hosted Codecov and Renovate state will be verified before closing the track.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[amazon-q-developer]

The integration of Renovate preset inheritance and Codecov OIDC authentication is well-implemented with comprehensive test coverage. The changes follow security best practices with commit-pinned actions and fail-closed behavior. All configurations are properly validated by the new test suite.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment

Thanks for integrating Codecov - We've got you covered ☂️