chore(release): prepare native 1.17.0 and exact-digest promotion

[rsvistel]

The meeting-publication migration needs a native server that supports immutable snapshots and a temporary legacy-write barrier. This prepares 1.17.0 on top of #230 and allows the existing deployment workflow to promote an already-built image by digest.

The Cargo manifest, lockfile and changelog agree on the version. For a normal deployment, the workflow now pins the exact dstack build output digest. A manual digest promotion skips rebuilding, verifies the selected image’s revision and version against the checked-out source, and then uses that immutable digest in the existing production compose. Deployment inputs, storage configuration, Phala CLI version and secrets remain unchanged. Two Rust unauthorized-error constructors now accept Box<Resource> so strict checks pass on the current compiler; authorization decisions and error messages are preserved.

Validation completed locally:

• The native candidate passed six real SDK/signed HTTP test groups covering scoped legacy writes, unrelated writes, new publication, cleanup rejection, generation checks and release. A separate restart test preserved the freeze and original data, then restored writes after release.
• A complete private legacy-catalog copy was imported, interrupted, resumed and repeated with exact originals preserved and no duplicate snapshots or operations.
• Five workflow tests passed, including invalid/mismatched digest inputs, image labels, failed dependencies, cancellation and build-only dispatch. YAML parsing, eight Bash syntax checks and diff-check passed. Actionlint was unavailable.

The local native test binary used local storage without default features. Final release source is 461e387b74c6760c5b48a265dca6a258667837c0, incorporating #230 through 59dfcc1. Current Rust 1.98.1 strict workspace/all-target Clippy and formatting pass locally. Final core/node library checks report 315 and 361 passes (five PostgreSQL tests skipped locally); the preceding Linux run passed all PostgreSQL-backed workspace tests. The final Linux CI run passed all six jobs, including 785 workspace tests and all five PostgreSQL integration tests (seven README doctests ignored). All 255 Rust files match the release branch exactly; its four additional changes are the version/lockfile, changelog and image-promotion workflow.

The final build-only container workflow is running with deployment disabled. The production-feature artifact and remote convergence remain separate validation steps; no production deployment or live catalog conversion is claimed here.

Rollout constraint: the guard adds a central SeaORM migration. An old 1.16.0 binary cannot simply restart against that applied migration. Recovery must retain a compatible migration list and, for activated catalogs, publication support and writer fences. See migration controls and recovery.

This is a draft stacked on #230. The operator sequence is build-only dispatch with image_version=1.17.0 and deployment disabled, inspect the resulting artifact, then promote that same source commit and reviewed digest. Publishing a version tag is not the build-only step because it triggers deployment.