fix(deps): switch Renovate to uv manager for lock-file-aware dep scanning

.pre-commit-config.yaml

@@ -157,7 +157,7 @@ repos:
       - id: codespell
         exclude: '(docs-reference/|\.git/)'
         args:
-          - --ignore-words-list=crate,nd,rouge,compiletime,intoto,ure
+          - --ignore-words-list=crate,nd,rouge,compiletime,intoto,ure,commitish
 
   - repo: https://github.com/adrienverge/yamllint
     rev: 8713140e99914c0cb6e07364daedfb140847c3c5  # v1.33.0

docs/superpowers/plans/2026-05-20-template-cleanup-cluster-D.md

@@ -943,10 +943,10 @@ DO NOT run `gh pr create`. Stop here and report the PR draft so the controller c
 
 ## Out of scope (deferred)
 
-- Cluster E items (MD040, MD051, planning front matter, PROJECT_SETUP workflow table, qlty CLI documentation) — this PR re-categorizes them in the feedback file but does not work on them.
-- Replacing interrogate with an alternative tool — this PR accepts the disputed CVE via allowlist; interrogate replacement is a separate decision.
-- Removing the `py` transitive dependency — out of our control until interrogate releases a fix.
-- OpenSSF baseline file changes (LICENSE, SECURITY.md, etc.) — untouched.
+- Cluster E items (MD040, MD051, planning front matter, PROJECT_SETUP workflow table, qlty CLI documentation): this PR re-categorizes them in the feedback file but does not work on them.
+- Replacing interrogate with an alternative tool: this PR accepts the disputed CVE via allowlist; interrogate replacement is a separate decision.
+- Removing the `py` transitive dependency: out of our control until interrogate releases a fix.
+- OpenSSF baseline file changes (LICENSE, SECURITY.md, etc.): untouched.
 
 ## Spec coverage self-check
 

docs/superpowers/specs/2026-05-20-template-cleanup-cluster-D-code-quality.md

@@ -134,11 +134,11 @@ Move those 5 entries to a new `## Cluster E: Documentation and MkDocs` section i
 
 Also remove the entries this PR closes:
 
-- "Transitive Dependency `py` Has Known Vulnerability (via interrogate)" — closed by component 1
-- "Template Missing Local SonarCloud Scanning Script" — REDIRECTED, remove
-- "Template-Generated Code Has BasedPyright Warnings (DETAILED)" — closed by components 2 and 3
-- "Template-Generated Scripts Fail Qlty Code Quality Checks" — closed by component 4
-- "Qlty Configuration Has Invalid Plugin Syntax" — already-FIXED, remove
+- "Transitive Dependency `py` Has Known Vulnerability (via interrogate)": closed by component 1
+- "Template Missing Local SonarCloud Scanning Script": REDIRECTED, remove
+- "Template-Generated Code Has BasedPyright Warnings (DETAILED)": closed by components 2 and 3
+- "Template-Generated Scripts Fail Qlty Code Quality Checks": closed by component 4
+- "Qlty Configuration Has Invalid Plugin Syntax": already-FIXED, remove
 
 Add a cleanup blockquote near the existing 2026-05-19 cleanup note:
 

renovate.json

@@ -78,8 +78,7 @@
     }
   ],
   "enabledManagers": [
-    "pep621",
-    "pip_requirements",
+    "uv",
     "github-actions"
   ],
   "separateMajorMinor": true,

{{cookiecutter.project_slug}}/renovate.json

@@ -25,16 +25,16 @@
   "packageRules": [
     {
       "description": "Group Python dependencies by type",
-      "matchManagers": ["poetry"],
+      "matchManagers": ["uv"],
       "matchDepTypes": ["dependencies"],
       "groupName": "Python dependencies",
       "automerge": false,
       "schedule": ["every weekend"]
     },
     {
       "description": "Group Python dev dependencies",
-      "matchManagers": ["poetry"],
-      "matchDepTypes": ["devDependencies"],
+      "matchManagers": ["uv"],
+      "matchDepTypes": ["dev"],
       "groupName": "Python dev dependencies",
       "automerge": false,
       "schedule": ["every weekend"]
@@ -95,13 +95,6 @@
       "labels": ["dependencies", "python-version", "breaking-change"]
     }
   ],
-  "python": {
-    "enabled": true
-  },
-  "poetry": {
-    "enabled": true,
-    "fileMatch": ["(^|/)pyproject\\.toml$"]
-  },
   "lockFileMaintenance": {
     "enabled": true,
     "schedule": ["before 5am on monday"],
@@ -125,9 +118,6 @@
   },
   "osvVulnerabilityAlerts": true,
   "transitiveRemediation": true,
-  "postUpdateOptions": [
-    "poetryMassage"
-  ],
   "customManagers": [
     {
       "customType": "regex",
@@ -138,7 +128,7 @@
     }
   ],
   "enabledManagers": [
-    "poetry",
+    "uv",
     "github-actions"
   ]
 }