fix(deps): deduplicate GitHub Actions updates

[ss-o]

Summary

• make Renovate propose only the highest available GitHub Actions release instead of parallel major and non-major updates
• retain grouped non-major action updates while keeping majors isolated and Dependency Dashboard approval-gated
• replace the custom weekly cron with Renovate's maintained weekly preset
• remove broad manager-wide grouping in favor of Renovate's curated monorepo and related-package groups
• document the organization grouping and bucketing policy

Why

F-Sy-H's Dependency Dashboard listed both actions/checkout v6.1.0 and v7.0.1 from the same v6.0.3 baseline. Renovate's default major/non-major buckets created two proposals for one dependency. Setting separateMajorMinor to false for the GitHub Actions manager makes Renovate select the highest applicable release while leaving unrelated major action upgrades isolated.

Broad manager-wide grouping also coupled unrelated dependencies. The revised preset keeps Renovate's maintained smart groups and limits the organization-wide custom group to non-major GitHub Actions updates.

Verification

• Renovate local-platform reproduction against actions/checkout v6.0.3:
  • old preset: 2 flattened updates, v6.1.0 and v7.0.1
  • new preset: 1 flattened update, v7.0.1
• renovate-config-validator --strict --no-global renovate-config.json .github/renovate.json: passed with Renovate's documented RegExp fallback because native RE2 was unavailable
• Trunk: 2 changed files checked, no issues
• agent policy and Zsh standard policy validators: passed
• policy validator unit tests: 183 passed
• git diff --check: passed

Relates to #452.
Addresses z-shell/F-Sy-H#111.