[kpal81xd]

Adds the same renovate.json as playcanvas/skills:

• config:recommended
• all npm dependencies in one group, pinned to exact versions
• all GitHub Actions in one group
• both groups run on Mondays at 10:00

Every dependency here is a dev dependency, because the published package is a self-contained bundle. Pinning only affects this repo's lockfile and package.json, not users. Renovate's npm manager reads package.json, so the plugin's npx …@x.y.z pin stays with the release workflow. renovate-config-validator passes.

Smoke test

1. After merge, open the repo's Pull requests tab. Renovate opens a "Configure Renovate" or dependency dashboard issue, or a first grouped PR. If neither appears, the Renovate GitHub app isn't enabled for this repo.