[Renovate Centralization] Phase 1: Policy reconciliation across existing configs #547

Context

Part of the Phase 1 discovery for epic #541 — Centralize Renovate config for openedx repos.

Task

Audit all ~53 existing renovate.json files and document where they disagree, then decide the org default for each policy dimension.

Known divergences to reconcile

• Automerge breadth: some repos automerge only minor+patch for @edx/@openedx packages; others automerge all minor+patch+pin+digest regardless of scope
• Schedule: weekly (many FE repos) vs. weekday mornings (some BE repos) vs. no schedule (some repos)
• Semantic commits: some repos enable :semanticCommits, others don't
• Vulnerability alerts: some enable :enableVulnerabilityAlerts, others don't
• prConcurrentLimit: only a few BE repos set this
• rebaseStalePrs / rebaseWhen: inconsistent across repos
• GitHub Actions updates: 30 repos have both Renovate (config:base enables Actions by default) and Dependabot for GitHub Actions — need to decide which owns this and disable the other

Questions to answer

• For each divergence: what is the org default? Where do we preserve per-repo behavior vs. unify?
• Should the central preset disable GitHub Actions updates in Renovate (since Dependabot already handles it)?

Output

A policy table in the design doc showing each setting, the current spread, and the chosen org default.

References

• Parent epic: Centralize Renovate config for openedx repos (frontend + backend) #541