refactor(renovate): require review for arillso/.github updates

[sbaerlocher]

Summary

• Set automerge: false for the arillso/.github package rule in renovate-base.json. Date tags cannot carry a digest, so pinDigests stays off — without automerge, a moved or compromised tag no longer propagates org-wide unreviewed within a day.
• Replaced the rule description with the reasoning, matching the two other pinDigests: false exceptions in the file that already carry an inline justification.

Test plan

• renovate-config-validator renovate-base.json passes (verified locally)
• CI green

[claude]

Thanks — the intent (require human review for our own CI-provider updates) is sound, the JSON is valid, and moving the rationale into the description matches the style of the two other pinDigests: false exceptions.

One substantive issue and one convention gap:

1. Grouping undercuts the automerge:false (inline). This rule doesn't override the groupName inherited from the earlier "Automerge all non-major updates" rule, so arillso date-tag patch/minor bumps land in the shared "all non-major dependencies" group. Because Renovate ANDs automerge across a group's members, an arillso bump will block automerge for that whole batch instead of surfacing as its own reviewable PR. Adding "groupName": "arillso/.github" isolates it and delivers the standalone review the new description promises.

2. No CHANGELOG entry. This is a consumer-affecting behavior change to a shared Renovate preset, and the repo consistently documents renovate-base.json changes in CHANGELOG.md (per AGENTS.md). Please add a dated entry.

[claude]

All raised issues have been addressed. The isolation fields correctly prevent the arillso dependency from inheriting the shared non-major group.

[sbaerlocher]

Closing: arillso/.github should track sbaerlocher/.github, which keeps automerge: true for its own date-tagged preset updates. Keeping main as-is aligns the two presets.