chore: release v0.17.0

[mostafa]

Summary

Release v0.17.0. Bumps the workspace from 0.16.0 to 0.17.0 (workspace package version plus all inter-crate path pins across the dependent crates), syncs both Cargo.lock and fuzz/Cargo.lock, and finalizes CHANGELOG.md by promoting the [Unreleased] block to [0.17.0] - 2026-06-23 with a TL;DR, a v0.16.0...v0.17.0 compare link, and the release reference link.

Headline framing: the "detection-engineering toolkit" release. The rule-side reporting suite that closes the program loop lands, alongside the daemon output-delivery layer and live daemon introspection.

• Detection-engineering reports: rule backtest replays an event corpus against a ruleset and diffs per-rule fire counts against declared expectations (feat(cli): add rule backtest corpus-replay harness #216); rule coverage maps a ruleset onto MITRE ATT&CK and exports a Navigator layer with gap analysis (feat(cli): add rule coverage for MITRE ATT&CK mapping #221); rule visibility turns the field-observability signal into a DeTT&CT administration pair and a visibility Navigator layer (feat(cli): add rule visibility (DeTT&CT export + visibility Navigator layer) #242); rule scorecard fuses backtest precision/recall, coverage, and fire volume into per-rule keep/tune/retire verdicts (feat(cli): add rule scorecard for per-rule keep/tune/retire verdicts #243).
• Output delivery: a per-sink async delivery layer with bounded queues, retry/backoff, batching, and an at-least-once ack-join across fan-out (feat(daemon): async sink delivery layer #222); an OTLP output sink over OTLP/HTTP and OTLP/gRPC (feat(daemon): OTLP output sink (OTLP/HTTP and OTLP/gRPC, with TLS) #223); a generic, template-driven webhook sink for Slack, Teams, Discord, PagerDuty, or any HTTP endpoint (feat(daemon): generic webhook output sink #227).
• Daemon introspection: engine status (feat(cli): add engine status command #237), engine tap for a redactable replayable fixture (feat: engine tap records the live event stream to a replayable fixture #238), and engine tail for live detections (feat: engine tail streams live detections to the terminal #239).
• Conversion reach: backend convert resolves native-first and delegates non-native targets to an installed sigma-cli, reaching the full pySigma backend ecosystem with no new dependency (feat(cli): delegate non-native backend convert targets to sigma-cli #241).
• rstix: Phase 2 STIX meta objects (feat(rstix): add STIX meta objects #213) and relationship/sighting objects (feat(rstix): add STIX relationship and sighting objects #220), thanks to @SecurityEnthusiast; the crate is not releasable on its own yet.
• Fibratus conversion fixes: emit the required version field (fix(convert): emit the required version field in Fibratus rules #219) and map file_access/file_event/create_remote_thread to their idiomatic macros (fix(convert): emit Fibratus file and remote-thread macros #217), thanks to @rabbitstack.
• Faster NATS and daemon integration tests: deterministic waits cut each suite by roughly 7x with no production code changes (test: speed up NATS and daemon integration tests #240).

Full release notes: see the new [0.17.0] section in CHANGELOG.md.

Test plan

• cargo fmt --all -- --check
• cargo metadata --locked for the workspace and fuzz/ (lockfile/manifest consistency)
• cargo clippy --workspace --all-targets --all-features -- -D warnings (CI)
• cargo test --workspace --all-features (CI)
• mkdocs build --strict (CI)
• cargo deny check (CI)

This commit is a version and changelog bump only; no source changed since the last merge to main, so the heavier gates are left to CI.

Post-merge

After merge, tag v0.17.0 on main and create the GitHub Release using the [0.17.0] body verbatim. The publish.yml, release-binaries.yml, and docker.yml workflows fire on release: published.