Automerge Renovate version bumps of MASH organization roles

Same rule mash-playbook has been running in production: role bumps from
mother-of-all-self-hosting merge via branch push (no PR) once the branch's
CI checks pass. The trust basis is the role repositories' own gates - each
release is cut by Molecule-verified, autotagged merges over there.

Bumps of devture roles and everything else keep their PRs. Extending the
same treatment to devture roles (here and in mash-playbook) is a discussed
follow-up.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BhJbmhyUpt4qSrKD9cbJ5A

.github/renovate.json

@@ -34,6 +34,15 @@
 			],
 			"allowedVersions": "/^v0\\./"
 		},
+		{
+			"description": "Automerge version bumps of roles maintained in the MASH organization (via branch push - no PR)",
+			"matchManagers": ["ansible-galaxy"],
+			"matchSourceUrls": [
+				"https://github.com/mother-of-all-self-hosting{/,}**"
+			],
+			"automerge": true,
+			"automergeType": "branch"
+		},
 		{
 			"matchFileNames": [
 				".github/workflows/close-stale-issues.yml",