drop renovate version pin and keep release-age cooldown for vulns

Unpinning the CLI keeps the previous install behavior, and leaving
minimumReleaseAge in place for vulnerabilityAlerts means a malicious
release can't be pulled in immediately.

.gitea/workflows/renovate.yml

@@ -3,7 +3,6 @@ name: Renovate
 on:
   workflow_dispatch:
   schedule:
-    # Every 6 hours is enough once deps are caught up; use workflow_dispatch to run now.
     - cron: "0 */6 * * *"
 
 jobs:
@@ -17,11 +16,20 @@ jobs:
       - name: Set up Node.js
         uses: https://git.keligrubb.com/actions/setup-node@v6
         with:
-          node-version: "24"
-          cache: npm
+          node-version: '24'
 
-      - name: Install dependencies
-        run: npm ci
+      - name: Cache npm and Renovate
+        uses: https://git.keligrubb.com/actions/cache@v6
+        with:
+          path: |
+            ~/.npm
+            ~/.cache/renovate
+          key: renovate-${{ runner.os }}-${{ hashFiles('renovate.json') }}
+          restore-keys: |
+            renovate-${{ runner.os }}-
+
+      - name: Install Renovate
+        run: npm i -g renovate
 
       - name: Run Renovate
         env:
@@ -31,4 +39,4 @@ jobs:
           RENOVATE_AUTODISCOVER: "true"
           RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}
           RENOVATE_CONFIG_FILE: renovate.json
-        run: npx renovate
+        run: renovate