v0.17.0 — ARM release, stream sync, bug patches

Client 0.17.0. The standard install one-liner now works on linux-arm64 — Raspberry Pi, Graviton, any aarch64 glibc 2.31+ host. The x86_64 build is unchanged. Both architectures are published as part of the same release and the install script detects the platform automatically.

New command: vault stream sync. Reconciles a known local stream against remote object existence, local receipts, and continuity export visibility. Accepts a stream ref or --all. Machine-readable report with stable additive keys.

Tier-aware stream cadence preflight: vault stream start now validates the requested cadence against the account plan before creating stream state. Too-fast cadences fail loudly before any objects are written.

Two bug patches: vault auth set-label no longer throws an unhandled exception on HTTP 4xx responses (caught ApiError alongside NetworkError). Server-side label column migration fixed for databases created before the column existed — label updates now return the normalized persisted value.