Play Framework

docs(claude): add the /renovate merge workflow command

Renovate pushes dependency-bump branches to the github remote that never
auto-merge -- renovate.json5 sets automerge:false for every Java/Ivy
update precisely because each needs a local `ant resolve` the bot cannot
run. Merging them was an undocumented manual sequence; this captures it.

Adapted from the equivalent command in the jclaw repo, but the ecosystem
split and the validation gates are specific to this repo:

  JAVA (dependencies.yml)  ant resolve -Dprune=true, then ant test
  WRAPPER (gradle/wrapper) same ant test run -- gradle-plugin-test
                           shells out to ./gradlew
  NPM-SKEL (nuxt-skel)     pnpm install + generate on a mktemp copy
  CI (.github/workflows)   no local gate; Actions validates on push

The core hazard it exists to prevent: framework/lib/*.jar is vendored and
committed, so a Renovate Java PR arrives with the manifest bumped and the
jars stale. CI builds that PR green against the OLD jars. The command
therefore treats `ant resolve` as mandatory and verifies the result by
checking framework/lib for paired add+delete churn rather than trusting
BUILD SUCCESSFUL -- the same "did it actually take" discipline the jclaw
version applies to its pnpm lockfile regen.

Two pre-merge checks come from bumps that already bit this repo: the
suffixed-sibling trap (net.bytebuddy's -jdk5 line, jakarta.inject's .MR,
both now pinned via allowedVersions) and confirming a wrapper bump
carries a matching distributionSha256Sum.

Stops at local commits. Pushing, the version bump, tagging and the
release stay with /deploy.

Exercised on its first run against PRs 25-29: it completed three Java
PRs whose CI was green against stale jars, and its skel gate caught the
pnpm 11 major breaking `pnpm run generate` (fixed in dc80c8cb1).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>