ci(renovate): silence github.com rate limit + skip internal workflow ref

Wire an optional read-only GITHUB_COM_TOKEN so Renovate can reach
api.github.com (changelogs + actions/checkout-style updates) without
rate limiting, and disable management of the internal Gitea reusable
workflow `played/workflows` (it's a @main ref, not a github.com action).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

renovate-config.json

@@ -15,6 +15,12 @@
 			"matchUpdateTypes": ["minor", "patch"],
 			"matchPackageNames": ["!/^@played//"],
 			"groupName": "non-major dependencies"
+		},
+		{
+			"description": "Internal Gitea reusable workflow (pinned @main) — not a github.com action, don't manage it.",
+			"matchManagers": ["github-actions"],
+			"matchPackageNames": ["played/workflows"],
+			"enabled": false
 		}
 	],
 	"lockFileMaintenance": {