Give Renovate quieter maintenance windows 🌙🌈

[scottgigawatt]

Renovate batches routine updates into quieter maintenance windows in America/New_York. Monthly maintenance runs from midnight to 08:00 on the first day; Docker references, PIA scripts, and current source-builder dependencies use the same Monday weekly window. At most two routine PRs can be open. 🌙🌈

Non-major maintenance updates share their monthly or weekly group. Major upgrades remain separate, require dashboard approval, and never auto-merge. Vulnerability alerts stay enabled and can open immediately outside those windows, ungrouped and without automatic merging or dashboard approval. Renovate controls the merge window instead of delegating early merges to GitHub. There is no cooldown.

This changes only .github/renovate.json5. Existing pins, versions, managers, npm/filelock constraints, security exceptions, and current dependency files remain unchanged. Existing squash auto-merge and rebase-when-behind behavior remain configured for routine updates. The current custom-builder managers remain until separately reviewed PR #120 removes them.

Validation: strict Renovate 44.49.0 repository validation passes for both this candidate and its combined tree with #120. An AST preservation check confirms all original managers, constraints, unrelated defaults, and package rules remain intact. A real three-way merge with signed #120 succeeds without conflicts. Central real-Renovate 44.49.0 validation passes all 243 assertions across the five enabled repository policies and the Privateerr+#120 combined tree: resolved presets, actual package-rule matching, New York/DST schedule boundaries, manual major upgrades, immediate vulnerability-alert overrides, and retained filelock/PIA/source-builder behavior. All five fresh GitHub checks pass at signed head 2344323939669775a35e18d954b33190c1ec7773, including complete repository validation, three-platform builds, both image gates, developer docs, and CodeQL (validation run). This PR is assigned for manual review with auto-merge off; it is not approved or merged.

• Strict Renovate 44.49.0 repository schema validation
• Original configuration preservation and clean merge with Restore official Buccaneerr tools with expiring CLI exceptions 🧭🌈 #120
• Central real-Renovate matching/schedule/security fixtures (243 assertions)
• Applicable config pre-commit checks and pinned CSpell (131 files, zero issues)
• All exact-head GitHub checks