chore: prepare release v0.17.0

[danbugs]

Bump workspace version from 0.16.0 to 0.17.0 and update CHANGELOG with all changes since v0.16.0. Key additions this release:

• macOS/Apple Silicon support via Hypervisor.framework
• SandboxBuilder API for ergonomic sandbox construction
• WIT source inputs in component bindgen macros
• Guest MSR save/restore across snapshots (breaking)
• RSS peak fix on Windows for snapshot restore

[ludfjig]

LGTM with some comments on changelog

[Copilot]

Pull request overview

Prepares the v0.17.0 release by bumping the workspace crate version and refreshing release artifacts (changelog and lockfiles) so the repository metadata matches the new published version.

Changes:

• Bump workspace package/crate versions from 0.16.0 to 0.17.0.
• Add a v0.17.0 section to CHANGELOG.md and update compare links.
• Regenerate Cargo.lock files (root and nested rust guest workspace) to reflect the new dependency graph.

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated 1 comment.

File	Description
Cargo.toml	Updates workspace version and internal crate dependency versions to 0.17.0.
CHANGELOG.md	Adds the v0.17.0 release notes and updates comparison links.
Cargo.lock	Refreshes the root workspace lockfile after the version bump.
src/tests/rust_guests/Cargo.lock	Refreshes the nested rust guest workspace lockfile.

Suppressed comments (1)

CHANGELOG.md:42

• This changelog entry ends with an author attribution but no PR link. Consider adding the PR URL (preferred) or dropping the attribution to keep v0.17.0 entries consistent and traceable.

* Validate ELF program headers in `ElfInfo::new()` to prevent host process abort from malformed guest binaries. PT_LOAD segments are now bounds-checked, `base_va`/`va_size` are stored as fields, and `load_at()` uses fully checked arithmetic by @danbugs

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.