chore(renovate): pin npm to v11 for lockfile updates

Renovate installs the latest npm (12.2.1) when unconstrained. npm 12 defaults to allow-remote=none and then refuses to read a package with bundleDependencies by its registry tarball URL (EALLOWREMOTE, npm/cli#9800), which breaks lockfile updates. npm 11 is what Node 24 ships. Drop the constraint once #9800 is fixed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BWDQY44qgQoePAsr8zpW4a

renovate.json

@@ -20,5 +20,8 @@
         "stylelint-config-standard"
       ]
     }
-  ]
+  ],
+  "constraints": {
+    "npm": "^11"
+  }
 }