chore(renovate): drop self-hosted runner from this PR (merge config only)

Per review feedback: remove the self-hosted Renovate deployment
(kubernetes/code/renovate/* + root kustomization wiring) from this PR and
defer it to a follow-up. Keep the renovate.json config to merge now.

Also drop the postUpgradeTasks SOPS re-encrypt block: it depended on the
runner's boot.sh decrypt flow, and the hosted Mend app cannot run 'sops'
(allowedPostUpgradeCommands). SOPS handling returns with the deployment.

kubernetes/kustomization.yaml

@@ -25,8 +25,6 @@ resources:
   - infrastructure/traefik
   - infrastructure/caddy
   - infrastructure/network/blocky
-  # Code (self-hosted dev tooling)
-  - code/renovate
   # Dev (developer platform)
   - dev/gitea
   - dev/harbor