Codex/consolidate ci workflows

[JSONbored]

Summary

Consolidates sure-aio CI into a single main workflow so pushes and PRs create one cleaner Actions run instead of separate build, security, and sync workflow runs.

Changes

• merged build, security, and awesome-unraid sync into one workflow
• kept check-upstream.yml separate as the scheduled updater
• added change detection so expensive jobs only run when relevant
• preserved the existing release policy:
  • validate on PRs/branch work
  • publish only from main

Validation

• workflow YAML parsed successfully
• consolidated job graph verified locally with act
• local linux/amd64 build passed
• full smoke test passed with exit code 0
• Renovate config validated successfully