chore: configure Renovate to pin GitHub Action digests

[Copilot]

Add helpers:pinGitHubActionDigests preset to pin GitHub Action references to immutable SHA digests for supply-chain security.

{
  "extends": [
    "config:recommended",
    "helpers:pinGitHubActionDigests"
  ]
}

The Python version constraint (allowedVersions: "<3.14") was initially added but removed since Renovate doesn't support dynamically trailing N minor versions behind. A static constraint would require manual config updates each Python release. Instead, unwanted Python upgrade PRs can simply be closed.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[deviantintegral]

@copilot I don't like how this requires manual updates for python in the renovate config. Is there a better way to do this? Or should we just remove the package rule and rely on closing pull requests?

[Copilot]

@copilot I don't like how this requires manual updates for python in the renovate config. Is there a better way to do this? Or should we just remove the package rule and rely on closing pull requests?

Renovate doesn't have a native "trail N minor versions behind" feature, so allowedVersions: "<3.14" would need manual bumps every Python release. Removed the package rule in 8b1ab9c — closing unwanted PRs is simpler and maintenance-free.