Bump SDK to v0.2.17: fix unreadable scoped grants and surface instance dependencies

[chrisghill]

Upgrades massdriver-sdk-go from v0.2.14 → v0.2.17, which fixes two issues surfaced by agent sessions.

1. list_resource_grants was unusable on any resource with a scoped grant

Listing grants on any resource carrying a scoped grant failed to decode:

PolicyConditions[md-environment]: json: cannot unmarshal string into Go value of type []string

The platform's grant read path serializes a single-valued condition as a bare
scalar string ({"md-environment":"s3demo-demo"}), but the SDK's
PolicyConditions.UnmarshalJSON only accepted "*" or a JSON array — so the entire
grant page failed to unmarshal, and there was no way to enumerate grants before
creating one. Fixed in the SDK (UnmarshalJSON now promotes a bare scalar to a
single-element set; "*" still maps to the wildcard). This repo just picks up the
fix via the dependency bump — the decode happens inside Instances/Resources
before the tool sees anything, so there's no in-repo code to change.

2. get_instance now returns incoming dependencies

Agents couldn't see what was wired into an instance. The SDK's instances.Get now
populates Instance.Dependencies (the filled connection slots — the upstream
resources feeding the instance). Because the handler serializes the full Instance,
this flows through automatically; the change here is to document it on the tool so
callers know to look, plus a test asserting dependencies serialize.

Changes

• go.mod / go.sum: massdriver-sdk-go v0.2.14 → v0.2.17
• get_instance description: note that dependencies (incoming connections) are returned
• Test: TestHandleGetInstance now covers an instance with a populated dependency

Verification

• go build ./..., go vet ./... clean
• Full test suite green

[chrisghill]

@claude review

[claude]

Claude finished @chrisghill's task in 1m 39s —— View job

---

Claude's Review

• Gather context (PR body, diff, files)
• Review go.mod/go.sum bump
• Review mcp/tools/instances.go change
• Review mcp/tools/instances_test.go change
• Review .github/workflows/docker-build.yaml and .goreleaser.yaml changes
• Post final review

Summary: Small, low-risk PR. The SDK bump + doc/test changes for get_instance are correct and well-scoped. CI is green (Lint, Test, Docker build all passed).

Findings:

1. Unrelated changes not mentioned in the PR description (.github/workflows/docker-build.yaml:26, .goreleaser.yaml:17-19) — the PR body only describes the SDK bump, the get_instance description update, and the dependencies test, but the diff also adds linux/arm64 to the Docker build matrix and removes the windows/arm64 ignore rule from goreleaser. These look like intentional infra changes (probably related to the arm64 SDK build), but since they're undocumented in the PR description, worth a sentence explaining why they're bundled here — makes the history easier to follow later. Not a blocker.

2. mcp/tools/instances.go:52-54 — description update is accurate and clear; correctly notes dependencies reflects incoming connections, matching what instances.Get now populates per the SDK bump.

3. mcp/tools/instances_test.go:134-153 — good coverage: asserts "dependencies" serializes into the JSON result via a populated types.InstanceDependency. Straightforward and matches the existing test style in the file (stub-based, table-driven).

4. go.sum — the three new massdriver-sdk-go entries (v0.2.15, v0.2.16, v0.2.17) alongside the existing v0.2.14 entry look correct for MVS resolution; go.mod correctly pins to v0.2.17 only.

No functional bugs found. The core fix (scoped-grant unmarshal) lives entirely in the upstream SDK so there's nothing in-repo to verify beyond the version bump, which CI confirms builds and passes tests.