v0.17.0 — governed PDM fleet control + proximo mint

Governed fleet control, and a one-command way in.

PDM fleet control (+12 → 364 tools). The Proxmox Datacenter Manager plane goes from read-only to governed guest control: power, snapshot create/rollback (auto safety-snapshot first), in-cluster migrate, and cross-remote, datacenter-to-datacenter migrate — every op dry-run-first (PLAN), receipt-logged to the hash-chained ledger (PROVE), task-backed, and (for rollback) auto-snapshotted before it acts (UNDO). The first governed PDM write surface in the field, live-proven end-to-end against a real PDM 1.1.4 + nested PVE 9.2 — including a real cross-datacenter move. Paths and request bodies were verified against the PDM API schema — nothing invented (PDM proxies no reboot/suspend, no lxc resume, no create/clone, so those are refused, not faked).

proximo mint. A print-only onboarding runbook — create → write → grant → wire → verify — for a least-privilege token on any of the four products (PVE / PBS / PMG / PDM). It makes no API call and never touches the secret; it just prints the exact steps, with the per-product credential-file formats and the two hard-won grant gotchas baked in.

Fixed

• Two multi-target (PROXIMO_TARGETS) bugs a production install surfaced: proximo doctor --target demanded single-target env; PROXIMO_LEDGER_REDACT was silently dropped in targets mode.
• Typed-API bugs the live-proves surfaced (the mocks encoded the same wrong assumptions): remote-migrate mapping params must be arrays not scalars; PDM booleans must be JSON true not int 1; remote-qualified task UPIDs.
• Three wrong-URL bugs fixed against the verified PVE 9 API schema.

Full detail in CHANGELOG.md.

Install: uvx proximo-proxmox · PyPI · GHCR (signed multi-arch). Apache 2.0.