fix(fleet): sync shared validation and trunk cleanup

[JSONbored]

Summary

• Syncs this repo with the latest shared aio-fleet workflow, validation, boilerplate, and Trunk cleanup.
• Pins reusable workflows to JSONbored/aio-fleet commit 4aea17371db2faf5ba759cda63b4f46aac514162.

What changed

• Regenerated thin reusable workflow callers.
• Synced the shared derived-repo validator shim and Trunk config updates.
• Formatted existing changelog content where Trunk required it.
• Added narrow per-file ShellCheck env-var annotations where this repo intentionally reads container-provided environment variables, if applicable.

Why

• Closes current fleet drift and makes future workflow/boilerplate/Trunk drift centrally detectable.

Validation

• trunk check --show-existing --all --no-fix --no-progress --color=false
• .venv/bin/python scripts/validate-template.py --all
• bash scripts/validate-derived-repo.sh .
• .venv/bin/python -m pytest tests/unit tests/template
• git diff --check

Notes

• Merge fix(fleet): harden shared validation and trunk checks aio-fleet#15 first so the pinned shared workflow commit is part of the central control-plane history.