chore: enable OSV alerts and restore bi-weekly major cadence (#26)

* chore: enable OSV vulnerability alerts

Turn on osvVulnerabilityAlerts so Renovate flags packages with known
CVE/OSV entries, and let vulnerability alert PRs bypass the regular
weekly schedule so security fixes can open any time.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: restore bi-weekly cadence for major updates via cron

Add a cron schedule to the bundled major-updates rule that matches the
first and third Monday of each month (days 1-7 and 15-21), giving
exact 14-day spacing. Without this, minimumReleaseAge alone only acts
as a staleness floor and the bundled PR can refresh weekly. With the
cron, the major dependencies PR only refreshes bi-weekly, honoring the
original "every 2 weeks" intent.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: designcode

renovate.json

@@ -6,17 +6,22 @@
 	"prConcurrentLimit": 5,
 	"prHourlyLimit": 2,
 	"labels": ["dependencies"],
+	"osvVulnerabilityAlerts": true,
+	"vulnerabilityAlerts": {
+		"schedule": ["at any time"]
+	},
 	"packageRules": [
 		{
 			"description": "Bundle all minor and patch updates (npm, GitHub Actions, Docker) into a single weekly PR",
 			"matchUpdateTypes": ["minor", "patch", "digest", "pin"],
 			"groupName": "non-major dependencies"
 		},
 		{
-			"description": "Major dependency updates: bundled, only after 14 days of release age (~bi-weekly cadence)",
+			"description": "Major dependency updates: bundled, bi-weekly cadence (first and third Monday) with a 14-day staleness floor",
 			"matchUpdateTypes": ["major"],
 			"groupName": "major dependencies",
-			"minimumReleaseAge": "14 days"
+			"minimumReleaseAge": "14 days",
+			"schedule": ["* 0-5 1-7,15-21 * 1"]
 		},
 		{
 			"description": "TypeScript and @types/node major updates: held 60 days post-release (~every 2 months)",