fix: add rebaseWhen behind-base-branch to keep Renovate PRs up to date

[dhudec]

Description

• Add "rebaseWhen": "behind-base-branch" to the org-wide Renovate config
• The inherited default from config:best-practices is "conflicted", which only rebases when there's a merge conflict
• With "behind-base-branch", Renovate will rebase open PRs whenever the base branch (master) moves forward
• This ensures that when a dependency PR is merged and the reactive trigger fires, the remaining open Renovate PRs get rebased and stay up to date

Business Impact

• Minimal — more CI runs on Renovate PRs (each rebase triggers CI), but PRs are always mergeable

Testing required outside of automated testing?

• Not Applicable

Screenshots (if appropriate):

• Not Applicable

Rollback / Rollforward Procedure

• Roll Forward
• Roll Back

Documentation

Reviewer Checklist

• Description of Change
• Description of Business Impact
• Description of outside testing if applicable
• Description of Roll Forward / Backward Procedure
• Documentation updated for Change