chore(renovate): drop self-hosted runner from this PR (merge config only)

Per review feedback: remove the self-hosted Renovate deployment
(kubernetes/code/renovate/* + root kustomization wiring) from this PR and
defer it to a follow-up. Keep the renovate.json config to merge now.

Also drop the postUpgradeTasks SOPS re-encrypt block: it depended on the
runner's boot.sh decrypt flow, and the hosted Mend app cannot run 'sops'
(allowedPostUpgradeCommands). SOPS handling returns with the deployment.

renovate.json

@@ -9,16 +9,6 @@
     "helm-values",
     "helmv3"
   ],
-  "postUpgradeTasks": {
-    "description": "Re-encrypt values.yaml after Renovate bumps an image tag. These files are decrypted to plaintext by the runner's boot.sh BEFORE Renovate extracts/edits them (Renovate has no preUpgradeTasks hook, and a post-edit decrypt would fail: editing a SOPS file invalidates its mac). So by the time this task runs, the file is plaintext and `sops -e -i` safely rebuilds a valid SOPS document carrying the bumped tag. branch mode re-encrypts each changed file once, after all deps on the branch are updated.",
-    "commands": [
-      "sops -e -i {{packageFile}}"
-    ],
-    "fileFilters": [
-      "**/values.yaml"
-    ],
-    "executionMode": "branch"
-  },
   "packageRules": [
     {
       "description": "docker-compose updates",