improve renovate: osv alerts, pin cli, slower cron

Prioritize vulnerability fix PRs, pin Renovate via package-lock for
reproducible runs, and drop the hourly schedule to every 6 hours.

.gitea/workflows/renovate.yml

@@ -3,7 +3,8 @@ name: Renovate
 on:
   workflow_dispatch:
   schedule:
-    - cron: "0 * * * *"
+    # Every 6 hours is enough once deps are caught up; use workflow_dispatch to run now.
+    - cron: "0 */6 * * *"
 
 jobs:
   renovate:
@@ -16,20 +17,11 @@ jobs:
       - name: Set up Node.js
         uses: https://git.keligrubb.com/actions/setup-node@v6
         with:
-          node-version: '24'
+          node-version: "24"
+          cache: npm
 
-      - name: Cache npm and Renovate
-        uses: https://git.keligrubb.com/actions/cache@v6
-        with:
-          path: |
-            ~/.npm
-            ~/.cache/renovate
-          key: renovate-${{ runner.os }}-${{ hashFiles('renovate.json') }}
-          restore-keys: |
-            renovate-${{ runner.os }}-
-
-      - name: Install Renovate
-        run: npm i -g renovate
+      - name: Install dependencies
+        run: npm ci
 
       - name: Run Renovate
         env:
@@ -39,4 +31,4 @@ jobs:
           RENOVATE_AUTODISCOVER: "true"
           RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}
           RENOVATE_CONFIG_FILE: renovate.json
-        run: renovate
+        run: npx renovate