Update atuin to 18.17.1 (#517)

18.12.1 -> 18.17.1. Source mirrored to
gs://minimal-staging-archives/atuinsh/atuin/v18.17.1.tar.gz
(sha256 851c3f48…, verified against the pin before and after upload).

⚠ TARBALL SIZE JUMPED 4x (803329 -> 3173022 bytes), which the updater's
2x guard correctly flags as the wrong-URL-class signature. Verified
LEGITIMATE: 18.13→18.17 added a whole new `atuin-ai` crate
(crates/atuin-ai/: driver, FSM, tool-calling, TUI) — 270 commits, ~39
new source files, no vendored blobs. pkgscan diff old→new is CLEAN
(risk 0.0). Shipped with `pkgmgr update --allow-size-jump` after that
review; this is the first use of that escape (pm#572).

License unchanged (MIT). This was dropped from the 2026-07-23 stacked
run purely on the size guard, with no escape hatch — which is why the
flag now exists.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: bryan-minimal

packages/atuin/build.ncl

@@ -6,14 +6,14 @@ let toolchain = import "../toolchain/build.ncl" in
 let gcc = import "../gcc/build.ncl" in
 let glibc = import "../glibc/build.ncl" in
 
-let version = "18.12.1" in
+let version = "18.17.1" in
 {
   name = "atuin",
   build_deps = [
     { file = "build.sh" } | Local,
     {
       url = "gs://minimal-staging-archives/atuinsh/atuin/v%{version}.tar.gz",
-      sha256 = "8643a7df1e366e9ad3134514b9bcaf4d6440accb13c64340ec9ec1923d58eb6e",
+      sha256 = "851c3f4870e4bd181b98d2dae60b9fd76ef30f05f16a85efa21ac7e7cf294862",
       extract = true,
       strip_prefix = "atuin-%{version}",
     } | Source,