docs(renovate): document onboarding / requireConfig options and the three models

Either way the admin run needs a token that can see the target repos.

## Onboarding & config-requirement options

These global options decide **whether a repo gets a starter PR** and **whether it

needs its own config to be managed**. They go in the admin config (or any global

config); they're global-only, so a repo's own `renovate.json` can't change them.

| Option | Values (default) | What it does |

| --- | --- | --- |

| `onboarding` | `true` \| `false` (`true`) | When `true`, Renovate opens an **onboarding PR** ("Configure Renovate", adds a starter `renovate.json`) in any in-scope repo that has no config yet. `false` = never open onboarding PRs. |

| `requireConfig` | `required` \| `optional` \| `ignored` (`required`) | Whether a repo must have its **own** config to be processed. `required` = skip repos without a `renovate.json` (they show as *disabled*). `optional` = process them too, using the inherited/global config. `ignored` = don't even check. |

| `onboardingConfig` | object (`{extends:[config:recommended]}`) | The config written into the onboarding PR's `renovate.json`. |

| `onboardingNoDeps` | `enabled` \| `disabled` (`disabled`) | Whether to still onboard a repo that has no detected dependencies. |

| `dependencyDashboardApproval` | `true` \| `false` (`false`) | Require ticking the **Dependency Dashboard** before any update MR is created. Repo-level (can be set globally and inherited). |

### The three workable combinations

| Goal | `onboarding` | `requireConfig` | Per-repo `renovate.json`? | Behavior |

| --- | --- | --- | --- | --- |

| **Classic onboarding** | `true` | `required` | created by Renovate | Renovate opens a "Configure Renovate" PR in each un-configured repo; merge it to activate. Good for letting repo owners opt in. |

| **Per-repo opt-in** | `false` | `required` | **required** (you commit it) | Only repos that already carry a `renovate.json` are managed; everything else is silently skipped. No surprise PRs. |

| **Centralized** (OTICA Model B) | `false` | `optional` | **not needed** | The admin config governs every repo in the `repositories` list; add a repo to the list and it's managed — no per-repo file. A repo may still add `renovate.json` to *override* the shared config (it merges; the repo wins on conflicts). |

OTICA's `make renovate-admin-update` writes the explicit `repositories` list; pick

one of the rows above for `onboarding`/`requireConfig` depending on whether you

want central control (Centralized) or explicit per-repo opt-in (Per-repo opt-in).

## Scheduled runs in GitLab CI (`.gitlab/renovate-ci.yml`)

For unattended updates, include the template and schedule a pipeline: