v17.2.0

macula 17.2.0

Release A0 of the sealed-by-default design (macula#135, macula#136): the reading
and resealing side only. A caller refused sealed_required by a keyed provider now
reseals to the key its signed refusal carries; a clear caller stream replays what
it already wrote under a sealed reopen. No default changes in this release.

Co-Authored-By: Claude Code <noreply@anthropic.com>