ci(renovate): add an opt-in preset for pinned zsh-lint releases

[ss-o]

Adds an opt-in Renovate preset, renovate-zsh-lint.json, that updates pinned zsh-lint analyzer releases in Zsh lint workflows. The zsh-lint v1.4.0 rollout (z-shell/zsh-lint#612) took seven hand-made pull requests for one commit bump.

The preset holds one regex manager (datasource github-tags, dependency z-shell/zsh-lint) for the two pin shapes the consumers use:

• zsh-lint-ref: <40-hex commit> # vX.Y.Z (callers of the reusable workflow, and zsh-lint-test.yml here);
• a repository: z-shell/zsh-lint checkout followed by ref: <40-hex commit> # vX.Y.Z (direct workflows).

Updates are grouped as zsh-lint analyzer.

knowledge/domains/ci/dependency-management.md keeps custom managers in the repositories that need them. This change adds that a manager several repositories need lives in an opt-in preset beside renovate-config.json, which each repository extends by name. The shared preset is unchanged, so no repository changes behaviour until it opts in. runbooks/dependency-management.md is regenerated.

Follow-up after merge: one small pull request per consumer adds local>z-shell/.github:renovate-zsh-lint to extends (zunit, zd, src, zsh-eza, zsh-fancy-completions, z-a-meta-plugins, and this repository for zsh-lint-test.yml).

Local checks on this head:

• both match strings, run against every workflow on each consumer's default branch, match exactly the one v1.4.0 pin in each of the 7 repositories and nothing else
• npx --package renovate renovate-config-validator renovate-zsh-lint.json renovate-config.json: validated
• python3 automation/knowledge/knowledge-delivery.py --check: 56 consumers ok; knowledge delivery and coverage unittests: OK
• trunk check --no-fix --ci on the changed files: no issues
• all 9 steps of agent-instructions.yml (after classifying the new file in knowledge/repository-files.json and adding its CODEOWNERS entry)

[ss-o]

Self-review of record on 5c97acc.

Read the full diff.

• The regexes require a 40-hex commit and a vX.Y.Z comment, so the reusable workflow's ${{ inputs.zsh-lint-ref }} reference is never matched.
• The preset is standalone, and renovate-config.json does not extend it.
• The runbook paragraph sits under the existing custom-manager rule and gives the opt-in extends line.

Checks on this head: the regex match against all 7 consumers, renovate-config-validator, knowledge-delivery --check and the knowledge unittests, as listed in the description.

No blocking findings.

[ss-o]

Self-review of record on e49a105, after the push that fixed the first head.

Validate Agent Instructions failed on 5c97acc because knowledge coverage requires every file to be classified, and renovate-zsh-lint.json was not. This head adds its entry to knowledge/repository-files.json (referenced, ci domain, like renovate-config.json), regenerates knowledge/domains/ci/repository-resources.md, and gives the file the same CODEOWNERS owner (@z-shell/tsc).

All 9 steps of agent-instructions.yml pass locally on this head: the agent-policy, knowledge, org-routing, decision-record and zsh-standard tests and validators.

No blocking findings.