chore(renovate): rebase conflicted PRs on every merge to main (#36)

Renovate only rebases while it runs, and it ran once a week, so merging one dependency PR left the others conflicted until the next Monday.

- `renovate.yml`: also run on push to `main` (mirror syncs fire push events, like `release.yaml`).
- `renovate.json5`: new PRs only in a Monday window (`* 4-6 * * 1`) around the weekly cron; on-merge runs only rebase conflicted PRs (`rebaseWhen: "conflicted"`).

Co-authored-by: Jean-Luc Makiola <business@jeanlucmakiola.de>
Reviewed-on: https://codeberg.org/jlmakiola/agendula/pulls/36

docs/RELEASING.md

@@ -94,10 +94,12 @@ release work when a merge actually cuts a release:
   `values-*/strings.xml`, so Weblate PRs get fast feedback. Runs on every PR
   without a path filter, so the required `Translations / check` status is always
   reported.
-- **`renovate.yml`** (`.gitea/workflows/`, Mondays 05:00 UTC plus
-  `workflow_dispatch`, **Gitea**) — the dependency sweep. Runs the pinned
-  Renovate image as its job container and targets Codeberg's API; the cadence
-  lives here, not in `renovate.json5`, so the two don't double-gate.
+- **`renovate.yml`** (`.gitea/workflows/`, Mondays 05:00 UTC, on push to
+  `main`, plus `workflow_dispatch`, **Gitea**) — the dependency sweep. Runs the
+  pinned Renovate image as its job container and targets Codeberg's API. New
+  PRs only open in the Monday `schedule` window in `renovate.json5` (keep it
+  bracketing the cron); the on-merge runs fall outside it and only rebase
+  existing PRs that the merge left conflicted.
 - **`release.yaml`** (`.gitea/workflows/`, on push to `main` plus
   `workflow_dispatch`, **Gitea**) — a cheap `detect` job reads `versionName` and
   checks **Codeberg** for a tag for it. Only when there isn't one does the