release: prepare beta17 hosted provenance

[Obed0101]

Problem

Beta16 release metadata was attested on Blacksmith self-hosted infrastructure, while the updater intentionally rejects self-hosted attestations with --deny-self-hosted-runners. Checksums and signatures were valid, but updates were blocked by the runner policy.

Solution

• Run the final release assembly and attestation job on GitHub-hosted ubuntu-24.04.
• Fail closed if the job is ever scheduled outside GitHub-hosted infrastructure.
• Keep the updater's self-hosted rejection unchanged.
• Add the 0.1.44-beta.17 changelog entry.

Validation

• node --test src/mendcode/script/release-index.test.mjs — 3 passed.
• Release workflow YAML parse — valid.
• Release provenance workflow contract check — valid.
• git diff --check — passed.
• Reproduced beta16 rejection and confirmed a GitHub-hosted attestation passes the same gh attestation verify --deny-self-hosted-runners policy.

Rollout

After merge, dispatch the release workflow from main for 0.1.44-beta.17, then verify checksums, attestations, the public installer, and the updater path.

This main-based promotion replaces the conflicting direct promotion PR #348.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}