v2.17.0

> [!NOTE]
> This release adds native Podman support, hostname configuration, and a delay option for new image auto-updates. It also improves performance and hardens Docker operations, projects, backups, and authentication.

### Features
- Add native Podman support and align its UI with the existing interface ([fd125ecc81692f3bda7c7e5e3eb7772458c7bd23](#), #4514; [7f06db1250ac0bf0dd3a5f338df2be7ebb6c3f90](#); @kmendell).
- Add hostname configuration ([d34c04623f3ea75cde0774715eefa8ebab74f158](#), #4391; @RobLoach).
- Add a delay before automatically updating newly available images ([c8fda2bd4459233ad47463618d2d195c76f717d9](#), #4459; @kmendell).

### Docker, images, and projects
- Fix interrupted image updates, preserve pulled image digests when tagging, include tagged images in age-based pruning, and count default networks as in use ([8928c098a978cb79cc4386707daabb7c2deb2f4f](#); [e68c9081ab86fd30e8568e5e4fdcad3b222319c3](#), #4482; [48539a169acedea1c012a07cb1011107becbffa0](#), #4477; [351fdfffc07df47eeef0ccf8e14d69779b13fb4f](#), #4476; @kmendell).
- Fix project updates to skip locally built services, use grouped pending paths, run bulk updates sequentially, and lock updates per project ([a1745df4cd0941184db548bb561a234d5279b1bc](#), #4499; [e46ccd526d959cdb094b4d62c83e5ddf21d0f25d](#), #4513; [4c98ef8f3938d43a6d47649bbb5d0415a32fb1a1](#), #4524; [c8ab0db42b45c44b295c86c40e32c7d06dd25cc3](#), #4520; @kmendell).
- Improve project workspace browsing with level-by-level traversal and a truncation alert; hide lifecycle actions for archived projects and return the correct status for project detail errors ([ecc20dfc46738c5ab9376b3917225455a84d3c8a](#), #4479; [4ebc8433987780626057b80ee819909bb2bd9510](#), #4502; [d2b14125858704b7aca85d378250086f9d055010](#); @kmendell).
- Improve Swarm manager unlocking, duration handling, and stack source and deletion behavior ([78a02e10082a20e5c0de62a7391f7acf1100fb85](#), #4505; @jmrplens).
- List networks with bare-address IPAM ranges ([6c4196ea3214d93cc8e888e25272ecb26baa1b29](#), #4498; @kmendell).
- Fix container redeploys, exec sessions, and streams ([a7812907535f79639abad968763508df60ee157b](#), #4488; @kmendell).
- Pass container IDs when preparing recreate host configuration in the CLI ([59b36160137a5498c7ce4a2655a7732bbe5e2929](#); @kmendell).

### Reliability, security, and backups
- Harden authentication and authorization, preserve browser sessions across tabs, and keep a global admin when roles are updated or deleted ([0e0a1d1fdd8f694a5f5534def32bf1e2b0ab73ad](#), #4492; [32a0ca34b25402ef8eb36d0ced8fdf4dec953f6b](#), #4472; @kmendell, @jmrplens).
- Make backup restores and recovery-key changes data-safe; skip volume backup pruning when the local repository hasn’t been created, and exclude GitOps scratch clones from system backups ([c2d8e8d6cab0b5d33a2c118028b7c437f75c44f7](#), #4487; [1ff65354b874d37372356651f74b83936dace463](#), #4448; [46742508904cf045a0a48d42544f999abf4c4072](#), #4519; @kmendell, @GiulioSavini).
- Recover scheduled runs whose completed result wasn’t recorded, and bound shutdown waits while hardening scheduler lifecycle ([01e67e9f787c2c003d0a42d6f9bc96a47c1275c9](#), #4458; [10ee66bbc4d2269eb768e57ad5e4cad11d7571c9](#), #4493; @kmendell).
- Harden edge environment access and health checks; keep pending edge environments pending on heartbeat ([edb390d61c7def6bf74fb9c196404fdf2d2a280b](#), #4489; @kmendell; [903a83a3b763a3c5906f3f6f1ae4867244e26482](#), #4507; @jmrplens).
- Improve backend stability and attestation fetches ([dac409fc372bb1ddd46ab9a3de9185d0a8bfa6df](#), #4491; @kmendell).
- Return 4xx responses for not-found and conflict errors ([efc38c1d8fa5288fc527a44fc7403b37efd078e8](#), #4506; @jmrplens).
- Send prune and update notifications even after context cancellation ([a41e677e7b7518b92f83acf24bcdf966033ef221](#), #4501; @kmendell).

### UI, templates, and integrations
- Use the opened resource’s environment in tab titles when all environments are enabled; compact table pagination on mobile ([a509628d4287d0abcc75ae0856ed4a5bfd17210b](#), #4450; [4d194f183d5ca6d77e217fb8a377a4c8a4db89d1](#), #4503; @DominikZublasing, @kmendell).
- Preserve folder templates and require `templates:create` permission to download them ([6f866ff60aa9ba5905031a0f4a7e4c5690b0a165](#), #4473; @jmrplens).
- Stream build workspace file downloads ([dfda96fef16a3fba848dedfd38b76568fb9f28fe](#), #4508; @jmrplens).
- Apply search and sorting to ignored vulnerabilities ([cc64070128b6e7f2f6e128dd1cbf25dc5ab25b04](#), #4509; @jmrplens).
- Keep the create button visible and accept unchanged environment values; update end-to-end tests for editor errors ([4d28457c19f2cf77d78da244521b657297994c08](#); [52b2eedf1c1fd91536061ebde508dcae4f76c092](#); @kmendell).
- Default password fields to `new-password` autocomplete ([161ac88b978d633db8f2be8f75fe9bed4e705438](#), #4485; @kmendell).
- Honor `update-check` in `x-arcane` Compose metadata ([aa5e3862de266dff4db21b151d38881cb0351eeb](#), #4457; @kmendell).
- Remove the `Accept-Encoding` header for GCS compatibility and default Rustic’s S3 signing region to `us-east-1` ([f9052166a72a5cd881bb83c5e35f4b230f985d03](#), #4446; [a0edb5bb4b0970c4a1eaeeab3acd725db1c2d344](#), #4478; @mbegerau, @kmendell).

### Performance and internal improvements
- Batch queries and cache service hot paths; share stats sampling and dashboard producers, and back off idle job scans ([a6b79438f328e8ee3c395d2c634ac3a776ab7770](#), #4438; [b31fae3c7543fa8c2ca3d5c24db8317eedc25c16](#), #4486; @kmendell).
- Refactor vulnerability, job, container, environment, network, updater, and image migrations to composite literals; remove dependency-injection nil checks ([9d10c2a543556868fa2af92498843c09126ca6b2](#); [d2b4166dfbb66f5e67c0801ceb0725825c7b79c2](#); [40365984a0b77645418f075026562ef00ad5432b](#); @kmendell).
- Rework the Docker boundary and image ownership logic ([fd742f3ee59451ecfa35198b26017116c439dd6d](#), #4484; @kmendell).
- Inline notification email templates in Go ([5b8c14016d11af356bcbeff4e1f6a5830c34a258](#), #4517; @kmendell).
- Update the updater dependency to v0.11.10 ([011a81e9c8628ae2913a065643f65560bd3aa60a](#), #4512; @kmendell).