0.17.0-rc.4

CLI and monitoring images.

- !422 (#381): mon local-install --instance-jobs / PGAI_INSTANCE_JOBS writes
  COMPOSE_PROFILES into the stack .env, so the outbound collection channel survives
  mon stop/start and mon update instead of being deleted by them. mon health now
  reports a fault when the profile is on and the container is absent, rather than
  '- not enabled'. Disabling a RUNNING container says so explicitly.

- !423 (#382, #348): mon local-install reports the platform's AAS reason instead of a
  bare status. A bare 'HTTP 400' is how platform-all#778 stayed invisible for three
  months across every console-provisioned box.

- !424 (#382): formatPlatformError scrubs by value BEFORE the pattern scrub, so a
  credential echoed with whitespace inside it can no longer have its tail reassembled
  by the flatten.

- !421 (#380): cli:npm:publish is idempotent and waits for the registry, which should
  restore the pgai wrapper alongside postgresai.

Known and shipped: postgresai#383 -- redactTextSecrets stops at the first whitespace,
so a wrapped credential we never sent keeps ~25 chars of its tail. Fix in flight (!425).