ci: update claude-code-action to v1.0.78 and pin trivy-action SHA

Update anthropics/claude-code-action from v1 to v1.0.78 in both AI workflows. Pin aquasecurity/trivy-action to fixed SHA in ci-ansible-collection.yml instead of mutable @master reference.

refactor(renovate): align Renovate presets with sbaerlocher/.github base

Synchronize all Renovate preset configurations to share the same base
conventions as sbaerlocher/.github.

renovate-base.json:
- Migrate deprecated stabilityDays → minimumReleaseAge
- Migrate deprecated fileMatch → managerFilePatterns
- Simplify non-major updates into one group (all-non-major)
- Change schedule to daily (before 6am) instead of Monday only
- Remove prCreation: not-pending, internalChecksFilter, dependencyDashboardApproval
- Add configMigration: true and npmDedupe/pnpmDedupe to postUpdateOptions
- Remove redundant group:allNonMajor and schedule:weekdays from extends

renovate-go.json:
- Migrate matchPackagePrefixes/matchPackagePatterns/excludePackagePrefixes
  to matchPackageNames with glob/regex patterns
- Migrate stabilityDays → minimumReleaseAge (4 occurrences)
- Migrate fileMatch → managerFilePatterns in all custom managers
- Remove redundant :semanticCommitTypeAll(chore) from extends
- Remove dependencyDashboardApproval

renovate-actions.json:
- Remove conflicting github-actions group rule (base handles this)
- Remove redundant platformAutomerge: true from package rule

renovate-ansible.json:
- Migrate fileMatch → managerFilePatterns in custom manager
- Migrate ansible-galaxy.fileMatch → ansible-galaxy.managerFilePatterns

fix: remove reserved github_token secret from cleanup workflow

The secret name `github_token` collides with a system reserved name
in workflow_call. Use `secrets.GITHUB_TOKEN` directly instead, which
is automatically available.

refactor: use official Anthropic code-review plugin for PR reviews

Replace manual review prompt and tool allowlist with the official
code-review plugin from claude-code-plugins.

fix: auto-select Python 3.12 for ansible-core >= 2.20

ansible-core 2.20 requires Python >= 3.12, but the sanity test
defaulted to 3.11. Now dynamically selects Python 3.12 for
stable-2.20 and above.