v1.17.4

What changed

See CHANGELOG.md
for this release's entry, written for the person installing it.

Verify what you downloaded

Every artifact below is published with its SHA-256 in a public,
append-only transparency log, a keyless cosign signature, a SLSA
build-provenance attestation, and a CycloneDX SBOM.

• Commands to check all of it: https://pollis.com/artifacts
• Whether this release rebuilt bit-for-bit from source:
  https://pollis.com/assurance

The installers verify automatically — install.sh requires the hash
it downloaded to appear in the transparency log at a different
origin from the CDN, and runs cosign when it is available.

---

What's Changed

• Org transfer finalize: drop the old signer, repoint relay image (#1265) by @actuallydan in #1357
• chore: refresh the rebuild ledger through v1.17.3 by @github-actions[bot] in #1359
• CI: explicit toolchain 1.96.0 on the dtolnay steps; pollis-verify 0.8.3 (#1353) by @actuallydan in #1354
• Rebuild ledger: classify v1.17.1's rebuild as environment drift by @actuallydan in #1358
• Mobile: show a new device's approval request on the phone (#1360) by @actuallydan in #1362
• QR sign-in the right way round: the new device shows the code, the signed-in phone scans it (#1361) by @actuallydan in #1363

Full Changelog: v1.17.3...v1.17.4