v0.17.0 — the walk, and a front door that signs

Ships @create-cmp/inspector 0.8.0 (the console) and @create-cmp/harness 0.15.0
(the walk lands in every generated project's lane).

Added

• The walk — you always know what it's doing and whose turn it is
  (docs/features/walk-status.md; born from the navigation-ia session: 20+ prompts, three
  interleaved walks, no shared map). Every governed change is now a walk through six
  stages spoken in human vocabulary — Decide · Design · Contract · Build · Prove ·
  Sign-off — with spec clauses rendered as promises ("keeping promise 5 of 7", in
  the clause's own words). It is a PROJECTION of the existing feature-board derivation
  (phase + nextStep), never new state. Surfaces, layered by reliability: qa/walk-status.mjs
  (cards · --statusline · --inject · --json, fail-open by contract), the template's
  statusLine (always-visible position, no agent involved), a UserPromptSubmit hook that
  re-anchors the agent with derived position + protocol on EVERY prompt (decay-proof:
  re-told, not remembered), and the contract's walk protocol (upfront itinerary with
  "stops for you: N", quiet one-line transitions, loud stop cards at human gates).
  Work no open walk accounts for renders as ▲ ARRIVED, UNPLANNED with the journal's
  reason — interleaving becomes an explicit choice, never an ambush. Deliberately NOT
  a second Stop hook: Stop stays the receipt gate alone (test-pinned); the statusline
  does the footer's job better.
• The front door signs. Every row in Overview's "What needs you" queue now carries its
  own control — Approve / Re-approve / Accept — with read it first beside it.
  This supersedes the front door's original "names the act, never signs" rule: what that
  rule protected (never sign what you have not read) is served by the evidence already on
  the row plus one-click read-through, not by a forced round trip. It is not a second
  path — the rows emit the same .approve-btn / .feature-accept-btn contract the owning
  sections do, so one approve endpoint, one accept endpoint, one ledger.

Fixed

• A refusal now surfaces on the panel the click came from. The approve/accept error
  path had exactly two boxes, on the Approvals and Features panels; a refusal triggered
  anywhere else wrote its reason into a hidden element on a tab the human was not looking
  at — a silent failure. Errors resolve to the clicking panel's .sig-error box, with the
  original ids as fallback.