feat(catalog): catalog IS the Renovate runner (self-included preset)

Summary

Conceptual sprawl reduction. The Renovate runner was a sister project. The catalog is the source of truth for the components Renovate keeps fresh; it should also be the operational center for the bot doing the keeping. One project, one set of practices.

What changed

• `presets/renovate-runner.gitlab-ci.yml` (new) — self-contained scheduled-pipeline shape (renovate + renovate-dry-run jobs, sensible defaults). Reusable by any operator standing one up; also self-included by this catalog.
• `.gitlab-ci.yml` — local-include of the preset, override of `AUTODISCOVER_FILTER` + `GIT_AUTHOR` + dry-run `REPOSITORIES`. New `renovate` stage gated by source=schedule|web (so commit/tag pipelines don't trigger Renovate).

Operational migration after merge + tag

1. Disable schedule on `renovate-runner` legacy project.
2. Move `RENOVATE_TOKEN` (masked CI variable) from the legacy runner project to the catalog project.
3. Create pipeline schedule on the catalog project (`0 6 * * 1` UTC).
4. Archive the legacy renovate-runner project.

Test plan

• MR pipeline green (lint + syntax)
• Tag v2.6.0
• Verify the new `renovate` stage shows up but doesn't fire on commit/tag pipelines (rules-gated)
• Operational migration steps completed