Summary

This PR wires up fully-automatic maintenance for the repo so that open security PRs merge themselves and a new PyPI release follows automatically.

1. renovate.json — automerge for Renovate PRs

• Security updates (matchCategories: ["security"]): automerged immediately with highest priority. This will finally close the 4 long-standing security PRs (chore(deps): update dependency cryptography to v46 [security] #21, chore(deps): update dependency requests to v2.32.4 [security] #24, chore(deps): update dependency pymdown-extensions to v10.16.1 [security] #25, chore(deps): update dependency pyjwt to v2.12.0 [security] #27).
• Minor/patch updates: automerged after a 3-day stabilisation period (grouped).
• platformAutomerge: true — uses GitHub's native auto-merge so it respects branch protection rules.
• Adds a dependencies label to all Renovate PRs for easy filtering.

2. pyproject.toml — loosen overly tight dependency pins

The previous constraints had patch-level upper bounds that directly blocked the open Renovate PRs:

PyJWT<3.0.0 and requests<3.0.0 are intentional major-version guards and are left as-is.

3. .github/workflows/auto-release.yml — automatic version tagging

After the existing Python CI workflow passes on develop, this workflow:

Path A — unreleased commits exist (e.g. after Renovate PRs merge):

1. Auto-bumps the patch version in pyproject.toml and __init__.py
2. Generates a .changelog/<new_version>.toml entry summarising the merged commits
3. Pushes the commit + tag → triggers release.yml → publishes to PyPI

Path B — version was manually bumped in a PR:

1. Checks that a .changelog/<version>.toml entry exists
2. If so, tags the version → triggers release.yml

Note: The auto-release commit is pushed with a RELEASE_TOKEN secret (falls back to GITHUB_TOKEN). For the tag push to trigger release.yml, a PAT stored as RELEASE_TOKEN is needed (pushes via GITHUB_TOKEN do not trigger further workflows). If you don't have one set up, you can add a fine-grained PAT with contents: write scope.

Test plan

• Merge this PR
• Verify Renovate re-evaluates the open security PRs and enables auto-merge on them
• Confirm that once a security PR merges and CI passes, auto-release.yml runs and a new patch tag appears
• Confirm release.yml picks up the tag and publishes to PyPI