Daily schedule (0 3 * * *) cuts OSV-alert latency to ≤1 day. Pinned to
renovatebot/github-action@8217b3fc (v46.1.15) with renovate-version fixed
to "46.1.15" — matches the repo's pin-everything posture (ADR-041).
Token wired via RENOVATE_TOKEN secret (contents+pull_request+issues scopes
on dedicated bot account). Platform/endpoint injected via env so renovate.json
stays purely dependency-rule-scoped.
Closes part of #818.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
