v0.17.0

• v0.17.0
• docs(changelog): promote 0.17.0 and correct the release-tooling note
• Merge pull request #41 from YawLabs/feat/tailscale-api-currency
• test(schema): pin the advertised enum against runtime extras
• test(keys): cover the OAuth-app fields that were declared but unexercised
• test(startup): pin that index.ts actually emits the mismatch warning
• test(launcher): cover sandboxFlags, the only shipped file with no tests
• fix(org-tailnets): reject whitespace-only input, do not silently default
• test(sandbox): pin the env allow-list against what src actually reads
• feat(startup): warn when the two tailnet variables disagree
• feat(org-tailnets): delete an explicitly-named tailnet
• fix(schema): advertise enum values to MCP clients again
• feat(local-cli): whoami and service list
• feat(keys): OAuth Apps for device provisioning
• feat(org-tailnets): manage organization tailnets
• feat(api): target API-only tailnets via TAILSCALE_OAUTH_TAILNET
• docs(webhooks): record the event-catalog audit against the live docs
• fix(errors): cite console.tailscale.com, not the legacy admin host
• fix(sandbox): grant TAILSCALE_LOCAL_CLI in the oam permission set
• fix(posture): accept every provider Tailscale supports
• docs(changelog): add the missing 0.16.0 entry