CI: scheduled dependency update PRs

## Background
Deps are updated manually.

## Why it matters
Stay current/secure.

## Acceptance criteria
- [ ] Add dependabot or renovate config for Python deps.
- [ ] Verify config is valid.

## Where to look
- `.github/`, `dependabot.yml`/`renovate.json`

## How to claim
Comment `/claim` on this issue.