v8.17.0

Release 8.17.0 — development → master

Rolls up 24 commits across three areas.

🛡️ App tampering — incident model (phase 1)

• New attributable, deduplicated, boot-aware incident schema replacing raw restart-row counting.
• Weighted distinct-incident tamper score; honest local event log with boot_id reboot tracking and episode dedup (capped API).
• Boot-storm discount limited to boot-race event types, then dropped entirely along with __system__ reboot rows.
• Identity hardening: backfill identity onto incidents recorded before fluxd is up, store nodeOutidx as a number, harden the identity race and public-endpoint input.
• Startup migration: purge all pre-schema rows and sweep legacy frequent_restart rows.

🔧 App reconciler — network heal

• Heal containers running detached from their docker network, without uninstalling the app (debounced, single inspect).
• Only heal a detached container when its network still exists; never destroy a detached container the heal cannot rebuild.
• Recreate a pruned per-app docker network in the reconciler heal path; consolidate soft-register onto ensureAppDockerNetwork and reserve legacy octets.
• Pace the network heal on the durable backoff ladder; stop the stats monitor before force-removing a detached container.

✅ Tests & version

• Extensive unit coverage for the tampering model, reconciler heal, docker service, app installer, and runtime state.
• Version bump 8.16.1 → 8.17.0.