fix(template): finalize CA metadata and upstream env coverage

[JSONbored]

Summary

Finalize Sure-AIO template readiness for CA and power-user parity with upstream docs, while keeping AIO-safe defaults.

What changed

• corrected CA category metadata in sure-aio.xml (Finance -> Utilities)
• exposed additional upstream-documented envs:
  • CATEGORIZATION_PROVIDER, CATEGORIZATION_MODEL
  • CHAT_PROVIDER, CHAT_MODEL
  • HTTPS_PROXY, HTTP_PROXY, NO_PROXY
• kept Skylight disabled-by-default for AIO and exposed optional opt-in auth fields
• updated template validator required targets for the expanded env surface
• refreshed pinned workflow/Dockerfile dependency refs from Renovate infra updates

Why

• CA was flagging Unknown category Finance
• users needed full upstream runtime/env control without editing the image/template manually
• repository had outstanding infra dependency drift in open Renovate PRs

Validation

• python3 scripts/validate-template.py
• python3 -m py_compile scripts/check-upstream.py scripts/validate-template.py
• python3 scripts/check-upstream.py
• docker build --platform linux/amd64 -t sure-aio:ci .
• bash ./scripts/smoke-test.sh sure-aio:ci

Notes

• merge to main will auto-publish container tags via CI (latest, v0.6.9, v0.6.9-aio-v1, sha-<commit>)
• formal GitHub Release/changelog tagging is still manual through Release / Sure-AIO workflow