Migrate release 0.2.5829 to Zig 0.17 without retrieval regressions

[justrach]

Goal

Ship the current release/0.2.5829 train on the pinned Zig 0.17.0-dev.813+2153f8143 toolchain while preserving 1:1 search/index behavior and making the migrated binary materially faster than the Zig 0.16.0 baseline.

Implementation: #674

Scope

• migrate the build, runtime, CI, release workflow, WASM target, and dependencies to the pinned Zig 0.17 development snapshot;
• preserve all retrieval contracts, including malformed/fragmented posting-list fallbacks and persisted-index behavior;
• optimize exact-word lookup, Tier-0 search aggregation, CLI startup, and cold trigram construction;
• add differential/parity coverage for optimized and defensive paths;
• document migration details, same-machine A/B methodology, measured gains, and remaining bottlenecks.

Acceptance criteria

• zig build test --summary all passes (892/896; 4 platform skips)
• MCP E2E scenarios pass (20/20)
• direct query hit counts and ordered parity checks match the Zig 0.16 baseline/control paths
• cold and warm CLI searches outperform the Zig 0.16.0 release baseline on the same immutable corpus
• release notes and migration guide document the change and caveats
• compiler and package versions are pinned and release metadata is synchronized
• cross-compiler benchmark CI compares the 0.16 base and 0.17 head without silently skipping; release: Zig 0.17 migration with faster, parity-guarded retrieval #674 is green

Benchmark baseline

Same-machine native arm64 ReleaseFast, immutable git archive corpus, Zig 0.16.0 at 428d8df versus the Zig 0.17 working tree. The migrated tree was initially effectively flat/slightly slower on cold paths, providing the red baseline for the optimization work. Full methodology and results are in #674, CHANGELOG.md, and docs/zig-0.17-migration.md.

[justrach]

Released in v0.2.5829. PR #674 merged; the release tag resolves to dd36e9431925014ee2bed80346669a4afee7e42e including the final Zig 0.17 Windows cross-compile fix. Five platform binaries plus checksums are published. Both macOS binaries are Developer ID signed and Apple notarization/Gatekeeper reports Notarized Developer ID (submission IDs recorded in the release notes). Public installer smoke test reports codedb 0.2.5829 and matches the published checksum.