## Summary

This PR wires up fully-automatic maintenance for the repo so that open
security PRs merge themselves and a new PyPI release follows
automatically.

### 1. `renovate.json` — automerge for Renovate PRs

- **Security updates** (`matchCategories: ["security"]`): automerged
immediately with highest priority. This will finally close the 4
long-standing security PRs (#21, #24, #25, #27).
- **Minor/patch updates**: automerged after a 3-day stabilisation period
(grouped).
- `platformAutomerge: true` — uses GitHub's native auto-merge so it
respects branch protection rules.
- Adds a `dependencies` label to all Renovate PRs for easy filtering.

### 2. `pyproject.toml` — loosen overly tight dependency pins

The previous constraints had patch-level upper bounds that directly
blocked the open Renovate PRs:

| Dep | Before | After |
|---|---|---|
| `cryptography` | `>=44.0.0,<44.0.1` | `>=44.0.0` |
| `urllib3` | `>=2.6.3,<2.6.4` | `>=2.6.3` |

`PyJWT<3.0.0` and `requests<3.0.0` are intentional major-version guards
and are left as-is.

### 3. `.github/workflows/auto-release.yml` — automatic version tagging

After the existing **Python CI** workflow passes on `develop`, this
workflow:

**Path A — unreleased commits exist (e.g. after Renovate PRs merge):**
1. Auto-bumps the patch version in `pyproject.toml` and `__init__.py`
2. Generates a `.changelog/<new_version>.toml` entry summarising the
merged commits
3. Pushes the commit + tag → triggers `release.yml` → publishes to PyPI

**Path B — version was manually bumped in a PR:**
1. Checks that a `.changelog/<version>.toml` entry exists
2. If so, tags the version → triggers `release.yml`

> **Note:** The auto-release commit is pushed with a `RELEASE_TOKEN`
secret (falls back to `GITHUB_TOKEN`). For the tag push to trigger
`release.yml`, a PAT stored as `RELEASE_TOKEN` is needed (pushes via
`GITHUB_TOKEN` do not trigger further workflows). If you don't have one
set up, you can add a fine-grained PAT with `contents: write` scope.

## Test plan

- [ ] Merge this PR
- [ ] Verify Renovate re-evaluates the open security PRs and enables
auto-merge on them
- [ ] Confirm that once a security PR merges and CI passes,
`auto-release.yml` runs and a new patch tag appears
- [ ] Confirm `release.yml` picks up the tag and publishes to PyPI

Co-authored-by: Claude Sonnet 4.6 <[email protected]>