release: v0.17.0

[octalide]

Cuts v0.17.0, versioning everything that landed on dev since v0.16.2 so it can sweep to main and tag.

Bumps mach.toml to 0.17.0 and converts the [Unreleased] CHANGELOG block into the [0.17.0] section (plus the entries that were merged without a changelog note: #337, #340, #349, #334, mach#1885, #280). Minor bump — substantial new public API (chrono/format/process/system/data.json) and a permanent aarch64 target, with fixes riding along.

Added

• chrono format_duration, format {:<N} left-align (mach#1774)
• runtime/linux static-PIE self-relocation (mach#1727) + PT_GNU_RELRO re-protection (mach#1778)
• process exec.spawn_redirected / exec.wait_any, os.cpu_count (process: public exec.spawn_redirected + exec.wait_any; os.cpu_count #331)
• data/json streaming NDJSON emitter + unified escapers (data/json: adopt the streaming ASCII escaper as the one JSON emission home (unify with mach.cli.json) #338), float number parsing (feat(data): float support in std.data.json number parsing #349), value_string_decode accessor (data/json: parse and emit disagree on string representation (raw wire bytes vs logical bytes) #340)
• build/ci permanent [target.linux-arm64] + cross-arm64 qemu lane (std: permanent [target.linux-arm64] + qemu aarch64 CI lane #280)

Fixed

• runtime/linux RELRO re-protection made fatal (runtime/linux: make RELRO re-protection failure fatal once the writer guarantees max-page alignment #347) and re-protecting the mapped extent not p_memsz — the critical arm64 --pie startup crash (mach#1885)
• system os.page_size sources AT_PAGESZ (runtime: surface AT_PAGESZ to the OS layer (page_size() hardcodes 4096) #336)
• data/json RFC 8259 emit escaping (data/json: emit writes strings unescaped — quotes/backslashes/control bytes produce invalid JSON #337)
• system/os/windows pin every ext import to its DLL (system/os/windows: pin every unpinned import with #[library] — kernel32 binding rides dependency-0 ordering #334)

Built with mach 2.14.1 (the current released compiler; CI/users pair std with the latest mach release). Sanity bar green locally against 2.14.1: mach build ., mach test . (620 passed / 0 failed), and the RELRO contract (test/relro/verify.sh).

Release choreography: once this merges to dev, a dev→main sweep tips main, then tag v0.17.0 (annotated) on the sweep merge commit → release.yml.