[squarepots]

Part of #110.

What changed

• .github/renovate.jsonc: minimumReleaseAge: "3 days" and internalChecksFilter: "strict" move from an npm-only package rule to the top level, so Cargo crates and GitHub Actions wait three days too. Security remediation keeps minimumReleaseAge: null under vulnerabilityAlerts and still opens immediately.
• docs/testing.md states the rule for both Renovate and hand-recreated updates.

Why

#236 already held back Cargo releases younger than three days by hand, including the 2026-10-28 Tauri plugin releases, whose Rust and npm halves Renovate groups together. With the age rule on npm only, approving the Tauri group would open a branch for the Rust half at once while the npm half still waits. The repository now applies one rule to every routine update instead of the reviewer remembering it for Cargo.

Validation

• The file still parses as JSON. Both options are standard top-level Renovate options. Renovate reports a config error on the dashboard if it rejects them.
• No workflow or source change.