ci: run workflows on renovate/** branches

[setchy]

What

Add the renovate/** branch pattern to the push triggers so CI runs on Renovate's update branches before they are pushed/merged.

Files: .github/workflows/ci.yml, .github/workflows/zizmor.yml

Why

Renovate is switching gitify-app/renovate-config workflow digest updates to branch automerge (automergeType: "branch", see gitify-app/renovate-config#9). That mode creates a branch and, once it's up to date and green, pushes the commit straight to the base branch — no PR.

Renovate waits for the branch's status checks. Our workflows currently trigger only on push: main + pull_request, so a renovate/** branch runs no checks and Renovate would eventually fall back to opening a PR (~25h). Renovate's docs explicitly require adding renovate/** to the testing workflow triggers for branch automerge.

Impact

• CI now also runs on renovate/** branches (every Renovate update branch in this repo, not just the digest bump).
• No change to main or PR behavior.

Follow-ups (outside this repo)

• Renovate must be a bypass actor with mode "Always allow" on the default-branch ruleset so it can push directly to the protected main; otherwise the push is rejected and it falls back to a PR.

[setchy]

Closing — no longer needed. We're keeping PR-based automerge for the gitify-app/renovate-config digest updates, so CI continues to run via the existing pull_request trigger. The renovate/** push trigger is only required for branch automerge, which we're not adopting.