chore: release v0.17.0

[lroolle]

Minor bump: two new features, four fixes.

Added

• kimi agent (feat: kimi agent (Moonshot Kimi Code CLI) #455) -- fifth launchable agent. Its auth model is unlike the
  others: kimi reads no API key from the shell, so api-key mode synthesizes
  the KIMI_MODEL_* family in memory and mounts nothing.
• cloak profile (feat: cloak profile - CloakBrowser stealth Chromium image #456) -- -p cloak runs agents against CloakBrowser stealth
  Chromium, headed on Xvfb, with VNC login, an always-on CDP-driven browser,
  and a persistent host profile so a login survives container removal.

Image policy this release establishes
cloak is an auxiliary image on its own cadence, not a general releasable
profile: it holds no agent CLIs and only changes when its own inputs change.
So nightly skips it and the release cloak job is non-gating
(continue-on-error, out of the release job's needs). A ~200MB Chromium
bake per arch must not decide whether a release ships. #485 tracks turning
that policy into a profile registry instead of duplicated strings.

Fixed

• deva claude --trace: run sessions under cctrace, with container-scoped CA trust #414 traced launches dying on a CA-install race, then on a set -e footgun
• image/tag precedence: a config-file DEVA_DOCKER_TAG beat the real
  environment and made -p a silent no-op
• --dry-run pulled multi-GB images and rewrote the resolved tag
• fix: deva.sh exits silently when docker rejects a .deva mount #484 silent exit when docker rejects a .deva mount

Three of these are the same bash trap: a failing command substitution in a
plain assignment aborts under set -e, quietly making the error handler
below it dead code.

Pins refreshed: claude-code 2.1.220, cctrace 0.23.0, gemini 0.52.0,
grok 0.2.112, kimi 0.29.2, ccx v0.12.0, playwright 1.62.0, cloakbrowser 0.5.2.

Tag goes on main's merge commit, not this branch head.

[claude-yolo]

Claude encountered an error after 1s —— View job

---

I'll analyze this and get back to you.

[Copilot]

Pull request overview

Bumps the project version to v0.17.0 and records the v0.17.0 release entry in the changelog, aligning the repository metadata with the release described in the PR.

Changes:

• Update deva.sh VERSION from 0.16.0 to 0.17.0.
• Add a ## [0.17.0] - 2026-07-27 section header to CHANGELOG.md to start the v0.17.0 release entry.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
deva.sh	Updates the script’s VERSION constant to 0.17.0.
CHANGELOG.md	Adds the v0.17.0 release header dated 2026-07-27.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1fab342f78

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update the released Kimi pin

Publishing the existing notes under the new 0.17.0 header makes them state that KIMI_CODE_VERSION is pinned at 0.28.0, while this commit's release tree has KIMI_CODE_VERSION=0.29.2 in versions.env. Anyone using the release notes to reproduce or audit the shipped image receives the wrong version, so update the Kimi pin stated in this release section to 0.29.2.

Useful? React with 👍 / 👎.