chore(release): 0.17.0 -- rail vetoes on the cycle line, and a console switcher with no tokens

[eaitbrahim]

Version bump for 0.17.0. It moves the eight workspace versions and the inter-package == pins together, plus uv.lock. Same shape as 0.16.0 (#806): 9 files, 25 lines in and 25 out. uv lock --check passes.

Why a minor bump: #810 and #814/#816 add console features. There is no schema change since v0.16.0 (keel/data/ is untouched), so upgrading needs no new migration.

What's in it since v0.16.0

• fix(execution): a cache record predating quote_increment is a MISS, not an "unknown" #807: a quote-increment cache record from before quote_increment existed now counts as a cache MISS, not "unknown".
• feat(console): the refusal now says how to GET the address it asks you to paste #810: the "refused" page now explains how to get the address it asks you to paste. fix(web): the refusal view declared note twice, so no page ran (#810 regression) #817 fixes a duplicate const note in that change, which had blanked the whole console on main.
• fix(agent): the cycle line counts rail vetoes and names the rail (#812) #813 (Summary line hides rail vetoes: signals=3 blocked=0 entered=0 reads as a silent drop #812): the per-cycle log line now ends with vetoed=N (rail, …), so an entry the rails refused no longer reads as a silent drop.
• feat(web): in-app profile switcher dropdown for multi-daemon navigation (#814) #815 + fix(web): the console switcher carries no token and sits beside the chip (#815 review) #816 (feat(web): in-app profile switcher dropdown for multi-daemon navigation #814): a console switcher next to the session chip. /api/config carries no session tokens; /switch/<port> sends the browser into the chosen console's own sign-in, on local deployments only.

After merge

1. Run Actions → Release with version 0.17.0.
2. Install into ~/keel using the runbook's "Deploying a new version" steps: back up each database, install the five wheels, run keel migrate, then keel versions and keel status.
3. Restart the four long-running keel serve consoles, since they keep the build they started with.

🤖 Generated with Claude Code