Document the Renovate setup and dependency holds in CLAUDE.md

[wormeyman]

CLAUDE.md and README.md currently contain zero mentions of Renovate, Dependabot or dependency automation. Verified:

$ grep -in "renovate\|dependabot\|dependency automation" CLAUDE.md README.md
(no matches)

This matters because the repo now has eight packageRules that will actively refuse or reshape dependency changes, and nothing in the contributor-facing docs says so. Someone hitting one of these will experience it as Renovate mysteriously not proposing an upgrade, with no pointer to where the reasoning lives.

The dependency holds themselves are well documented - in .csproj comments and in .github/renovate.json5 - but only if you already know to look there.

Suggested addition to CLAUDE.md

A short subsection covering:

• Dependency automation is Renovate, configured at .github/renovate.json5 (JSON5 so the reasoning lives in comments beside each rule).
• Updates arrive as a weekly batch, Monday morning America/Los_Angeles. Security fixes bypass that schedule.
• Nothing automerges. Every bump gets read.
• There are deliberate holds. Before "fixing" a stale-looking version, read the rule - each carries its reason and the condition under which to revisit.
• The dependency dashboard (Dependency dashboard #41) is the live inventory of what is held back and why, and is a better place to look than reading manifests by hand.
• Validate any edit with npx --yes --package renovate -- renovate-config-validator, and note that with "Require config file" enabled a broken config on the default branch makes Renovate do nothing silently.

Also worth cross-referencing

The .csproj hold comments and the Renovate rules currently duplicate each other's reasoning, which is deliberate but means they can drift. A line in each pointing at the other would make a mismatch easier to notice.

[wormeyman]

Done in #51 (merged as b68d22b). CLAUDE.md now has a "Dependency automation" section covering the weekly schedule, that nothing automerges and why, that holds exist and carry their own reasoning, the tracking-issue convention, and the dashboard as the live inventory - plus the silent failure mode with "Require config file" and the two adjacent traps (only one config file may exist; narrowed matchers fail silently).

Not auto-closed by the merge because the commit said "Resolves #45 and #46" - GitHub binds the keyword to the first number only.