chore: enforce 7-day minimum release age for supply chain hardening (#550)

- Add minimumReleaseAge (7 days) + internalChecksFilter (strict) to Renovate config
- Disable Renovate automerge (was the root cause of #548 re-merging overnight)
- Add minimumReleaseAge (604800s) to bunfig.toml for bun install/update
- Exclude @pierre/diffs from age gate (current ^1.1.12 can't resolve under 7-day gate)
- Bump audited deps: diff 8.0.4, claude-agent-sdk 0.2.92, codex-sdk 0.118.0, marked 17.0.6, @types/node 25.5.2
- Add /update-deps skill for supply chain audited dependency updates

For provenance purposes, this commit was AI assisted.

package.json

@@ -33,18 +33,18 @@
     "typecheck": "tsc --noEmit -p packages/shared/tsconfig.json && tsc --noEmit -p packages/ai/tsconfig.json && tsc --noEmit -p packages/server/tsconfig.json"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.2.81",
-    "@openai/codex-sdk": "^0.116.0",
+    "@anthropic-ai/claude-agent-sdk": "^0.2.92",
+    "@openai/codex-sdk": "^0.118.0",
     "@opencode-ai/sdk": "^1.3.0",
     "@pierre/diffs": "^1.1.12",
-    "diff": "^8.0.3",
+    "diff": "^8.0.4",
     "dockview-react": "^5.2.0",
     "dompurify": "^3.3.3",
-    "marked": "^17.0.5"
+    "marked": "^17.0.6"
   },
   "devDependencies": {
     "@types/dompurify": "^3.2.0",
-    "@types/node": "^25.5.0",
+    "@types/node": "^25.5.2",
     "@types/turndown": "^5.0.6",
     "bun-types": "^1.3.11"
   }