v0.17.0

v0.17.0: 6 fixes, 5 features, 1 tests, 4 docs, 1 chores.

Fixes

• give the LocalSystem NSSM service gh on PATH + logging (#258) (#259) (#258 #259)
• -InstallService no longer aborts on a fresh install (#256) (#257) (#256 #257)
• auto-pin current actions/runner version + SHA at scaffold, warn on staleness (#249) (#249)
• distinct concurrency group for verify.runner.yml variant (#248) (#248)
• back off on build/container failure, not just mint (#247) (#247)
• make docker compose build/config succeed without a JIT config (#246) (#246)

Features

• service-install tooling for the supervisors (systemd --user + NSSM) (#255) (#255)
• add forge:runner-check adoption-readiness preflight (#250) (#250)
• runner-health check (ADR-0005 AC4, #225) (#231) (#225 #231)
• forge.json runner block + validation + docs (#226) (#230) (#226 #230)
• scaffold local self-hosted runner + private-only refusal (#224) (#229) (#224 #229)

Tests

• raise vitest timeout for the slower self-hosted runner (#251) (#252) (#251 #252)

Docs

• adoption guide + known-issues runbook (#243) (#244) (#243 #244)
• accept ADR-0005 local self-hosted runner (AC1 sign-off) (#180) (#228) (#180 #228)
• public-facing README + repo description/topics pass (#213) (#218) (#213 #218)
• add OSS community health files (#217) (#217)

Chores

• OSS gate — full-history secret scan + repeatable tooling (#210) (#216) (#210 #216)

Deploy notes

• Infra changed: no
• Migrations to run: no