ci(fleet): centralize trunk config and gate release tags

[JSONbored]

Summary

• consume the shared unraid-aio Trunk plugin config
• only emit immutable release tags on real release commits
• document the publish and release tag behavior

Validation

• trunk check --show-existing --all
• python3 scripts/validate-template.py
• pytest tests/unit tests/template
• pytest tests/integration -m integration
• ./trunk-analytics-cli validate --junit-paths "reports/pytest-unit.xml,reports/pytest-integration.xml"
• git diff --check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5659c99272

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Accept release commit titles with PR suffix

The release tag detection now requires an exact line match on chore(release): <version>, but GitHub squash merges commonly produce chore(release): <version> (#123). In that case release_package_tag stays empty, so the publish job skips pushing the immutable <upstream>-aio.N image tag and related wrapper metadata on the release commit. This breaks the documented release flow for repos that use the default squash-merge title format.

Useful? React with 👍 / 👎.