ci: update README, add Renovate, auto-approve, autolabeler, and homebrew-tap dispatch

[wax911]

Summary

Updates the outdated README to reflect actual implementation status and adds CI automation improvements inspired by anitrend/on-the-edge.

README Update

• All 14 implemented commands marked as "Implemented" (was "Planned")
• Removed overrides row (no standalone command; functionality via --override flag on generate, render, up)
• Fixed sync description to "Validate generated stacks match committed files (CI drift detection)"
• Fixed logs and doctor descriptions to match actual CLI output
• Fixed secrets subcommand descriptions (deploy, clean, check) to match CLI
• Added Features section, secrets/env subcommand tables, and GitHub Actions section
• Removed "once released" caveat from Quick Start
• Homebrew instructions and release badge deferred to post-v0.1.0

Release Drafter Improvements

• Added collapse-after: 5 to all categories in release-drafter-config.yml
• Added dependencies/.+ branch regex for :dagger: dependencies autolabeler label (required for Renovate PRs)
• Fixed *.md to **/*.md glob in docs autolabeler rule
• Split autolabeler into separate release-drafter-autolabeler.yml workflow using pull_request_target only (handles fork PRs, avoids duplicate runs)
• Removed pull_request trigger from release-drafter.yml (moved to autolabeler workflow)

Renovate + Auto-approve

• Added renovate.json with baseBranches: ["main"], automerge: false initially, major version guard via packageRules
• Added auto-approve.yml workflow using hmarr/auto-approve-action@v4, filtered to renovate[bot] actor at job level

CI Fixes

• Removed non-existent dev branch from ci.yml triggers and build job guard (3 locations)

Homebrew-tap Dispatch

• Added gated repository_dispatch step in release.yml to trigger anitrend/homebrew-tap formula update on release
• Uses actions/create-github-app-token@v3 with APP_ID and APP_PRIVATE_KEY secrets (same pattern as anitrend/on-the-edge)
• Gated behind ENABLE_HOMEBREW_DISPATCH repo variable (already set to true) with continue-on-error: true

Required Secrets (not yet set)

• APP_ID - GitHub App client ID (App must be installed on AniTrend/homebrew-tap with actions: write permission)
• APP_PRIVATE_KEY - GitHub App private key

Follow-up Items (separate PRs)

• Set APP_ID and APP_PRIVATE_KEY secrets in repo settings
• Merge homebrew-tap#13 (enables repository_dispatch receiver and switches to app-token)
• Flip automerge: true in renovate.json after CI proven stable
• Add Homebrew install instructions and release badge to README after v0.1.0 release