The rules were copied into each app's renovate.json, so they were identical only by luck
and a change meant six edits — the Testcontainers guard existed in two repos and not the
other four. Apps now extend this.
Also records the two majors that are blocked upstream rather than by our code:
typescript-eslint peers at typescript <6.1, eslint-plugin-react peers at eslint <=9.7.
