Migrate GitHub Actions deps to Renovate (keep npm on Dependabot) (#72)

## Summary

- Remove `github-actions` ecosystem entry from `.github/dependabot.yml`
— now managed by shared
[CopilotKit/renovate](https://github.com/CopilotKit/renovate) config
- Delete `dependabot-auto-merge.yml` and `dependabot-major-analysis.yml`
workflows (GHA-specific)
- **Preserve** npm ecosystem entry in `dependabot.yml` (weekly,
@copilotkit/* grouping, jpr5 reviewer)

Part of [Renovate org rollout — Phase
1](https://www.notion.so/copilotkit/3613aa38185281a38863fcff2907021c).

## What stays on Dependabot

| Ecosystem | Directory | Interval |
|-----------|-----------|----------|
| npm       | `/`       | weekly   |

## What moves to Renovate

| Ecosystem      | Previously | Now |
|----------------|-----------|-----|
| github-actions | Dependabot (daily) | CopilotKit/renovate shared
config |

Author: jpr5

.github/dependabot.yml

@@ -13,26 +13,3 @@ updates:
     open-pull-requests-limit: 10
     cooldown:
       default-days: 1
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: daily
-    groups:
-      minor-and-patch:
-        patterns: ["*"]
-        update-types:
-          - minor
-          - patch
-      major:
-        patterns: ["*"]
-        update-types:
-          - major
-    labels:
-      - dependencies
-      - github-actions
-    commit-message:
-      prefix: "ci"
-      include: "scope"
-    open-pull-requests-limit: 10
-    cooldown:
-      default-days: 1

.github/workflows/dependabot-auto-merge.yml

@@ -1,12 +1,6 @@
 rules:
   dangerous-triggers:
     ignore:
-      # Dependabot auto-merge: uses pull_request_target for write token.
-      # Does NOT checkout PR code. Actor-gated to dependabot[bot].
-      - dependabot-auto-merge.yml
-      # Dependabot major analysis: uses pull_request_target for PR comments.
-      # Does NOT checkout PR code. Actor-gated to dependabot[bot].
-      - dependabot-major-analysis.yml
       # notify-pr.yml uses pull_request_target but only curls a Slack webhook.
       # It has permissions: {} so no token is exposed.
       - notify-pr.yml