v0.17: compatibility, Linux hardening, and contextual tool discovery

[raiseCatError]

Summary

v0.17 "Compatibility & Discovery". Code and automated coverage only; no physical validation in iTerm2, Kitty, WezTerm, Windows Terminal, Linux or WSL 2 was performed (tracked in #310 and #311).

/tools

• Relevant here: conservative group in Discover from bounded existence checks (Git parents ≤ 8, top-level shell scripts, package.json, Python/Go/Rust markers, container files, Kubernetes manifests or kubeconfig) and each tool's declared relevantTo. Missing tools only; nothing executed, crawled or sent.
• Package managers: typed executable + argv plans for Homebrew, APT, DNF, pacman, zypper (from /etc/os-release, WSL included). Only curated names; otherwise manual. Non-root plans are explicit sudo -n; failures name the command to run yourself.
• Bulk install: Space selects, Enter reviews tool → manager → package, one confirmation (default No), per-tool results, failures stay selected.
• Activation: Installed / selected in NMSh / Active in this shell for zoxide, Atuin, fzf from the shared shell name snapshot; rc files are never read.

Hosts, Linux, WSL

• Windows Terminal profile (via WT_SESSION), iTerm2 and WezTerm new-window launchers, multiplexer/dumb degradation tests for every profile.
• xdg-open/wslview helper, clipboard fallback order tests, Fish on Ubuntu CI, Fedora subset job, support-level tables in docs/architecture/platforms.md.
• CLI/TUI: raw job-control/EOF/arrow bytes reach full-screen programs.

Updates and sessions

• Automatic / Notify only / Off with Daily/Weekly; saved intent migrates conservatively (Off stays Off, Daily/Weekly → Notify only). Automatic preparation reuses planUpdate/applyUpdate (same checks, build verification, rollback) at an idle point; the running version stays distinct from the installed one; no retry storm.
• Startup picker X kill with confirmation through the existing killAndArchive.

Screensavers

• Black Hole, Fireworks, Circletastic, raiseCatError animate the captured visible screen (presentation only). Random picks from the whole saver registry (existing and new), switching only at each saver's natural loop boundary. Still off by default; Run while busy never overrides passthrough.

Verification

• npm run build, npm run typecheck, git diff --check: pass.
• npm test at default concurrency: 1510 tests, 0 failures, 0 skipped. CI on 4852ada: macOS and Ubuntu (Node 22/26) and the Fedora subset all pass.

Not done / follow-ups

• Physical validation: Physical validation: iTerm2, Kitty, WezTerm and Windows Terminal #310 (hosts), Physical validation: Linux and WSL 2 #311 (Linux/WSL).
• /update keeps its existing transcript-based presentation rather than a new panel.