ci(renovate): add reusable Renovate config validator workflow

[setchy]

What

Adds a reusable Renovate config validator workflow to the org .github repository.

• Validates preset files by explicit filename with --strict (the validator's default file matching does not recognise default.json).
• Auto-detects the target files: a repo's own config (renovate.json* / .renovaterc*) if present, otherwise all root *.json presets.
• Exposes workflow_call so consumer repositories can reuse it for their own renovate.json.
• Runs on push/pull_request to main for *.json changes.

This is draft PR 1 of 2 for the harden-org-renovate-preset change and is the validation gate that makes tracking main unpinned safe. The follow-up PR adds the preset policy, onboarding hook, and named presets.

Verification

• npx --package renovate -- renovate-config-validator --strict ./default.json passes locally (exit 0).
• The workflow runs on this PR (path filter includes the workflow file) and should report a green check.

Note

Do not merge before review. The follow-up policy PR depends on this workflow existing.