[CI] configure automerge for renovate, use devbox for GHA on build+test

[AshleyDumaine]

What this PR does / why we need it:
Automerge is enabled on this repo so this PR lets renovate make use of that for anything that's not a major version update which we'll very likely want to manually verify ourselves.

Tests passing and 1 approval are already required for a merge to happen, enabling automerge just requires one less click to merge once approved and tests are all green.

This also updates the build/test actions in GHA to use devbox to mimic dev workflow to make sure dependency bumps on devbox are verified. We need to remove disable-sudo for devbox to work on hardened runners for the appropriate job where needed.

TODOs:

• squashed commits
• includes documentation
• adds unit tests
• adds or updates e2e tests

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.88%. Comparing base (43d0fa2) to head (c9cc503).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1047   +/-   ##
=======================================
  Coverage   67.88%   67.88%           
=======================================
  Files          71       71           
  Lines        6480     6480           
=======================================
  Hits         4399     4399           
  Misses       1808     1808           
  Partials      273      273           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.