Replace projected Dependabot with a repo-global Renovate deps gate (monorepo root)

[markmals]

Supersedes #42. Lands the local-Renovate dependency gate, reworked to fit the mise-monorepo model that landed on main after #42 was written (members carry no [tools]; the swift family contributes none at all). #42's per-member approach is now architecturally incompatible — web_test.go asserts members have no [tools] — so this implements the gate once, at the repo root.

What changed

wireMonorepo — alongside maintaining the root mise.toml — now wires a single repo-global dependency-update gate, present from the first target add:

• EnsureRootMise → ensureDepsGate merges the gate's [tools] (node, npm:renovate, jq) into the root's single [tools] table (deduped against family pins; never overwrites a user pin) and appends [tasks.deps] (advisory local Renovate dry-run — never opens PRs, always exits 0) + [tasks.check] (repo-wide aggregate).
• EnsureDepsGateFiles drops renovate.json + scripts/deps-check.sh at the repo root (skip-existing).
• Sources live at internal/coreassets/templates/monorepo/{renovate.json,deps-check.sh}.

Dependabot removed: the web scaffold's .github/dependabot.yml.tmpl (the only projected Dependabot config) is deleted; web_test.go asserts no dependabot.yml is projected.

Why root-level (vs #42's per-stack)

A monorepo has one root mise.toml and Renovate is ecosystem-agnostic — one root-level scan covers every member (npm, gomod, SwiftPM, Actions, Docker, mise tools). This:

• kills the 5× deps-check.sh duplication Replace projected Dependabot with a local Renovate dependency gate #42 flagged,
• resolves Replace projected Dependabot with a local Renovate dependency gate #42's Swift call-out: the gate is repo-global infra, not a family contribution, so the swift-no-tools invariant holds and Go/Swift stacks gain no node tooling of their own.

Notes

• New tomlKey() quotes mise tool-backend keys like npm:renovate (the colon makes the bare form invalid TOML), while the idempotency compare stays on the decoded bare key. Explicitly tested.
• node = "24" in the gate matches the node family default, so a node repo dedupes to one entry; it only actually pins node in Go/Swift-only repos (which need it to run the Renovate CLI).

Verification

• mise run ci (build + vet + gofmt + go test ./...) — green.
• New scaffold unit tests: deps gate injected, idempotent, [tools] created when a family has none, npm:renovate emitted quoted + re-parses, EnsureDepsGateFiles writes + skips-existing + executable script.
• Monorepo e2e test (real embedded assets): root gets the gate + renovate.json + scripts/deps-check.sh; the member stays gate-free.
• Golden init trees unaffected (the gate is a target add artifact, not init).