Adds a Renovate custom-regex manager that keeps the CLI tools pinned in
the build scripts (shellcheck, shfmt, oras, bat) up to date — it opens a
PR when a newer GitHub release is published. depName is read from the
release URL the scripts already carry, so the sources need no extra
markup; an explicit variable-name allow-list limits tracking to these
tools. Config lives in renovate.json5 with the line contract documented
in plain language. Scoped to custom.regex so GitHub Actions and Python
stay with Dependabot.
