ci(renovate): add reusable Renovate config validator workflow

.github/workflows/renovate-config-validator.yml

@@ -0,0 +1,69 @@
+name: Renovate Config Validation
+
+on:
+  # Reusable: consumers call this to validate their own Renovate config.
+  workflow_call:
+    inputs:
+      files:
+        description: Space-separated Renovate config/preset files to validate. Empty auto-detects.
+        required: false
+        type: string
+        default: ""
+  # Self-triggered: validate the preset files in this repository.
+  push:
+    branches:
+      - main
+    paths:
+      - "*.json"
+      - ".github/workflows/renovate-config-validator.yml"
+  pull_request:
+    paths:
+      - "*.json"
+      - ".github/workflows/renovate-config-validator.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Validate Renovate config
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+
+      - name: Determine files to validate
+        id: files
+        env:
+          INPUT_FILES: ${{ inputs.files }}
+        run: |
+          set -euo pipefail
+          if [ -n "${INPUT_FILES}" ]; then
+            # Explicit list supplied by the caller.
+            FILES="${INPUT_FILES}"
+          elif compgen -G "renovate.json*" >/dev/null || compgen -G ".renovaterc*" >/dev/null; then
+            # A repository's own Renovate config.
+            FILES="$(ls renovate.json renovate.json5 renovate.jsonc \
+              .renovaterc .renovaterc.json .renovaterc.jsonc .renovaterc.json5 2>/dev/null || true)"
+          else
+            # Preset repository: every root JSON file is a preset.
+            FILES="$(ls ./*.json 2>/dev/null || true)"
+          fi
+          if [ -z "${FILES}" ]; then
+            echo "No Renovate config or preset files found to validate." >&2
+            exit 1
+          fi
+          echo "Validating: ${FILES}"
+          echo "files=${FILES}" >> "$GITHUB_OUTPUT"
+
+      - name: Validate Renovate config
+        run: >-
+          npx --yes --ignore-scripts --package renovate --
+          renovate-config-validator --strict ${{ steps.files.outputs.files }}