Prioritize vulnerability fix PRs, pin Renovate via package-lock for reproducible runs, and drop the hourly schedule to every 6 hours.