fix(ci): split kotlin renovate updates from patch group

Author: trask

.github/renovate.json5

@@ -34,6 +34,17 @@
       ],
       groupName: 'weekly update',
     },
+    {
+      // keep Kotlin Gradle plugin updates out of the catch-all patch PR because CodeQL often
+      // fails on them, which blocks unrelated patch updates
+      matchDepNames: [
+        'org.jetbrains.kotlin.jvm',
+      ],
+      schedule: [
+        '* 0-7 * * 2', // weekly, before 8am on Tuesday
+      ],
+      groupName: 'kotlin plugin updates',
+    },
 
     // ── Version constraints ────────────────────────────────────────────