fix(renovate): keep Node.js and pnpm upgrades out of the bot

Renovate bumped .nvmrc and the packageManager pin in isolation, so the
check-node-toolchain contract failed (engines.node, @types/node and the Docker
node image are intentionally upgraded together) and the grouped PR could never
pass check. Disable the nvm manager, the Dockerfile node image and the pnpm
packageManager field so those rollouts stay manual and coordinated.

renovate.json

@@ -32,6 +32,22 @@
 			"description": "Docker-compose draait op :latest; geen digest-pin-ruis",
 			"matchManagers": ["docker-compose"],
 			"pinDigests": false
+		},
+		{
+			"description": "Node-upgrades worden handmatig gecoördineerd over .nvmrc, package.json engines, @types/node, de Docker-basisimage en de runner; Renovate mag .nvmrc niet los bumpen (check-node-toolchain faalt anders)",
+			"matchManagers": ["nvm"],
+			"enabled": false
+		},
+		{
+			"description": "De Node-basisimage in de Dockerfile hoort bij dezelfde gecoördineerde Node-upgrade als .nvmrc",
+			"matchManagers": ["dockerfile"],
+			"matchPackageNames": ["node"],
+			"enabled": false
+		},
+		{
+			"description": "De pnpm packageManager-pin is afgestemd op Docker en de runner-toolchain; niet automatisch bumpen",
+			"matchPackageNames": ["pnpm"],
+			"enabled": false
 		}
 	]
 }