Configure Renovate to label patch/minor/pin/digest/lockFileMaintenance updates with 'automerge'. Add a merge-renovate job to ci.yml that runs after the check job passes on Renovate branches and merges PRs carrying that label; major-version PRs are left for manual review. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>