style: apply vp check --fix to the renovate config and CLAUDE.md

Caught by the CI workflow from #56 on its first real use - `vp check` (no --fix)
failed in 27s on two formatting issues. Worth noting the gate earned its keep
immediately on a comment-only change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F3a2HLJ4beKARi7SPmaM54

Author: wormeyman

.github/renovate.json5

@@ -91,7 +91,7 @@
     schedule: [],
     minimumReleaseAge: "25 hours",
     prBodyNotes: [
-      "Security update - this bypassed the weekly schedule deliberately. Still read it: `brace-expansion`'s advisory carries a flat `<=5.0.7` range, so `pnpm audit` flags a version that already has the fix. \"The audit is red\" is not by itself a reason to take a bump here.",
+      'Security update - this bypassed the weekly schedule deliberately. Still read it: `brace-expansion`\'s advisory carries a flat `<=5.0.7` range, so `pnpm audit` flags a version that already has the fix. "The audit is red" is not by itself a reason to take a bump here.',
     ],
   },
 

CLAUDE.md

@@ -216,7 +216,7 @@ that PR is wrong; fix the age rule, don't commit the bypass.
 
 **The app is live as of 2026-07-30** - enabled with "Automated PRs", "Require
 config file" and "Create onboarding PRs". So Renovate opens real PRs on its own
-now; `automerge: false` is what keeps anything from *landing* unread, and
+now; `automerge: false` is what keeps anything from _landing_ unread, and
 `dependencyDashboardApproval` is deliberately unset because it would re-impose
 scan-only behaviour at the config layer and defeat the app setting.