ci(sync): refresh catalog assets

[JSONbored]

Summary

• refresh catalog XML for Sure, Sure alpha, Infisical, and Penpot
• update the thin validate-catalog workflow to the latest merged aio-fleet pin
• refresh the centrally generated catalog changelog

What changed

• synced sure-aio.xml and sure-aio-alpha.xml from current sure-aio source
• synced infisical-aio.xml from current infisical-aio source
• synced penpot-aio.xml after the Penpot media-storage release PR merged
• updated .github/workflows/validate-catalog.yml to pin aio-fleet at the merged catalog-workflow renderer commit
• refreshed CHANGELOG.md from the centralized catalog changelog command

Why

The catalog copy was stale relative to source XML and the required thin validation workflow had drifted from the centralized aio-fleet renderer. This keeps awesome-unraid as the CA-facing asset repository while leaving automation logic in aio-fleet.

Validation

• python -m aio_fleet validate-catalog --catalog-path .
• python -m aio_fleet catalog-audit --catalog-path .
• python -m aio_fleet catalog-changelog --catalog-path . --check
• git diff --check
• Local hooks ran Trunk and catalog checks during commit

Notes

• The workflow keeps actions/checkout pinned to v6.0.3 and only updates the aio-fleet ref.