chore(sync): update upstream pins for penpot-aio

[aio-fleetbot]

Summary

• Updates upstream pins for penpot-aio.

What changed

• Penpot Frontend: 2.16.0 -> 2.17.0 plus image digest refresh
• Release notes: https://github.com/penpot/penpot/releases
• Penpot Backend: 2.16.0 -> 2.17.0 plus image digest refresh
• Release notes: https://github.com/penpot/penpot/releases
• Penpot Exporter: 2.16.0 -> 2.17.0 plus image digest refresh
• Release notes: https://github.com/penpot/penpot/releases
• Penpot MCP: 2.16.0 -> 2.17.0 plus image digest refresh
• Release notes: https://github.com/penpot/penpot/releases
• Mailpit: v1.30.2 -> v1.30.6 plus image digest refresh
• Release notes: https://github.com/axllent/mailpit/releases
• Source repo paths reviewed/generated:
  • Dockerfile
  • docs/upstream/penpot-config-inventory.json
  • penpot-aio.xml

Why

• Keeps the AIO wrapper aligned with upstream while preserving human review.
• Source repo changes are validated here first; catalog sync follows the validated source repo and never starts in awesome-unraid.

Validation

• Generated by aio-fleet upstream monitor; central checks should run on this PR.
• The generated commit must be verified/signed before branch protection allows merge.

Safety assessment

• Safety: warn (0.50 confidence)
• Config delta: none
• Template impact: xml-changed-without-config-target-delta
• Runtime smoke: configured-not-seen
• Next action: penpot-aio.xml Config target diff unavailable
• Review warning: penpot-aio.xml Config target diff unavailable
• Review warning: release notes inspection pending on dashboard refresh
• Review warning: runtime/integration tests are configured but no PR runtime check was found
• Dashboard safety state is authoritative after this PR and its checks are visible to aio-fleet.