chore(deps): standardize Renovate config location

[ss-o]

Summary

• make .github/renovate.json the preferred consumer-config location
• document Renovate config discovery precedence and prevent duplicate locations
• update branch-protection and new-repository guidance
• move this repository consumer config while retaining the root organization preset

Validation

• organization agent-policy validators
• secured Trunk check for all edited files
• Renovate JSON syntax and semantic checks
• git diff --check

Relates to #452