The pull request that hands version updates to Renovate is folded in
here, so that the two workflow changes are tested and merged once.

Renovate proposes the version updates of this repository from now on.
It watches what Dependabot watched, looks once a week, takes a release
a week after it is published, opens one pull request for each kind of
dependency with at most two open, and rebases a pull request only when
it conflicts. A dashboard issue lists what is pending.

The Dependabot configuration is removed, which turns its version
updates off. Dependabot keeps its alerts and its security updates,
which are repository settings. Renovate does not open its own pull
requests for vulnerabilities, so one advisory does not get two fixes.

The configuration passes Renovate's validator and takes effect when
the Renovate app is installed on the repository.

ci.yml already has a dependency-review job, which I missed. The
workflow this branch added ran the same review a second time on every
pull request, so it is removed; the existing job stays as it is.

The owner decided against running OpenSSF Scorecard here. The workflow
added by the commit before this one is removed; nothing else changes.

zizmor audits the workflows themselves for what makes a workflow
unsafe, and uploads what it finds to code scanning. Its first run here
found one thing, 4 times: a checkout that leaves the job's token in
the checked-out repository, where any later step can read it. No
workflow pushes or needs the token after the checkout, so every checkout
now sets persist-credentials to false, and zizmor reports nothing.

OpenSSF Scorecard grades how the repository is kept: branch protection,
pinned dependencies, token permissions and the like. It runs on the
default branch and weekly, publishes its score and uploads its findings to
code scanning.

Dependency Review fails a pull request that adds or changes a dependency
with a known vulnerability of high severity or worse. Dependabot watches
what is already there; this holds what comes in.

Every new action is pinned to a commit, each job names the permissions
it needs, and no new workflow has a default permission.

Language

Hebrew (he-IL) joins English, German and Russian on the language site, in
the page metadata and in the list the backend reports.

A visitor who has not chosen a language now starts in the language of their
browser: the first preferred language that is published, compared by primary
language, with `iw` accepted as the former code for Hebrew. A browser that
prefers no published language gets en-US. A choice made in the menu is kept
under a new storage key and always wins. The earlier key was written on every
visit, so it could not tell a choice from the former English default; it is
no longer read, which resets an earlier explicit choice once.

Hebrew does not mirror the page. The layout, the navigation and code keep
their left-to-right arrangement; only text follows the language. The onward
arrow points left in Hebrew, and a left-to-right mark keeps "Visual X#"
intact inside right-to-left text.

The forum placeholder no longer has a language menu. It shows its one notice
in the language of the browser, with English as the fallback, and stores no
language. Its assets get a new cache key.

The single documentation column may now shrink below its widest code line.
Before, a long command widened the page on narrow screens, which cut
right-aligned text off.

The Hebrew text was not reviewed by a native speaker.

Documentation gate

The backend applies Dokka 2.2.0 with reportUndocumented and failOnWarning,
its public declarations have KDoc, and CI runs dokkaGenerate. The dependency
lock file and the verification metadata include the new artifacts.

Verified locally: frontend tests, type check, prettier and build; backend
test, bootJar and dokkaGenerate, which was also shown to fail on an
undocumented declaration; the Hebrew pages in a browser. The forum page was
exercised by its tests only.