chore(sync): update upstream pins for sure-aio

[aio-fleetbot]

Summary

• Updates upstream pins for sure-aio.

What changed

• Sure: 0.7.2 -> 0.7.3 plus image digest refresh
• Release notes: https://github.com/we-promise/sure/releases
• Sure Alpha: 0.7.3-alpha.6 -> 0.7.4-alpha.5 plus image digest refresh
• Release notes: https://github.com/we-promise/sure/releases
• Source repo paths reviewed/generated:
  • CHANGELOG.alpha.md
  • Dockerfile
  • Dockerfile.alpha

Why

• Keeps the AIO wrapper aligned with upstream while preserving human review.
• Source repo changes are validated here first; catalog sync follows the validated source repo and never starts in awesome-unraid.

Validation

• Generated by aio-fleet upstream monitor; central checks should run on this PR.
• The generated commit must be verified/signed before branch protection allows merge.

Safety assessment

• Safety: blocked (0.10 confidence)
• Config delta: none
• Template impact: manifest-targets-present
• Runtime smoke: configured-not-seen
• Next action: unexpected upstream PR file(s): CHANGELOG.alpha.md, Dockerfile.alpha
• Blocking finding: unexpected upstream PR file(s): CHANGELOG.alpha.md, Dockerfile.alpha
• Review warning: release notes inspection pending on dashboard refresh
• Review warning: runtime/integration tests are configured but no PR runtime check was found
• Dashboard safety state is authoritative after this PR and its checks are visible to aio-fleet.

[dosubot]

📄 Knowledge review

Dosu skipped reviewing this PR because your organization has used its 200 included credits for the month. Your usage will reset on 2026-09-01. To have Dosu review this PR before then, ask your organization admin to upgrade to a pro account.

---