[rmcdaniel]

Release prep for Waterline 2.17.0, following the 2.16.0 prep (00e3c49):

• composer.json dev-main 2.17.x-dev, product-train 2.17.0;
• service-image workflows, the OCI publication scripts and their tests, and docs/image-publication.md move to the fixed 2.17.0 candidate;
• CHANGELOG 2.17.0 section.

Contents since 2.16.0:

• replay-blocked runs on the dashboard (Show replay-blocked runs on the dashboard #292, Show replay-blocked runs on the dashboard (#292) #296);
• embedded schedule visibility queries (Filter schedules by workflow type in Waterline #226, Support schedule visibility queries in embedded mode #290);
• keyboard and screen-reader fixes, plus no unhandled rejection on the default-view save (Clear SonarCloud reliability findings in the UI #293);
• devcontainer and CI download hardening (Harden devcontainer and CI install steps flagged by SonarQube #291, Harden two CI install steps (hash-bound PyYAML, npm ci --ignore-scripts) #294, Harden devcontainer and CI downloads (#291) #295).

After merge: tag 2.17.0, publish the GitHub Release, check Packagist, then run the protected service-image publication for docker.io/durableworkflow/waterline:2.17.0 per docs/image-publication.md.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud