ci(renovate): enable auto-merge for soaked updates

[perfectra1n]

What

Enables auto-merge for this repo's already-soaked updates. The config already waited 3 days on minor/patch/pin/digest but never set automerge, so those PRs just sat. This:

• adds automerge: true to that existing soak rule (so soaked minor/patch/pin/digest land; major still opens a PR), and
• sets automergeType: pr + automergeStrategy: squash + platformAutomerge: false so Renovate merges via its own API — the pattern that works on private repos without GitHub native auto-merge (matches sibling repos like atviksecurity-com-site, tyrfing-artifacts-mcp, VulnCorp).

Why

Green dependency PRs were piling up awaiting manual merge despite the soak already passing. Part of the org-wide auto-merge rollout.

Safety

• 3-day soak unchanged.
• major updates are excluded (no rule enables them) → still manual.
• Merges only when checks pass.