Prepare SQLX v0.1.7 release

[openai0229]

What

Release preparation for 0.1.7, which ships the seven merged fixes and features: dsh/pi Skill targets (#11), the PostgreSQL server message (#12), skill status/remove (#13), the --tls disable hint (#14), quiet JDBC logs (#15), broken-pipe handling (#16) and boundary-aware redaction (#17).

• Version 0.1.6 → 0.1.7 in Cargo.toml (workspace), Cargo.lock, java/jdbc/pom.xml, packages/npm-installer/package.json and the packaging scripts.
• .github/workflows/packages.yml: every v0.1.6 became v0.1.7, including the release title (a separate literal that a plain v0.1.6 replacement misses).
• Skill compatibility moves to >=0.1.7, <0.2.0 in SKILL.md, references/install-cli.md and references/local-ui.md.
• scripts/jdbc-fixture.sh and the README build-from-source paths use the 0.1.7 JDBC jar (the fixture script was the stale reference that broke the previous release's JDBC jobs).
• tests/updates.py: CURRENT 0.1.7, NEXT 0.1.8.
• docs/release-notes.md rewritten for 0.1.7: the two new Skill commands, the error-message improvements, and the broken-pipe fix.
• One doc fix found while reviewing: the README installer section still listed only codex and claude.

Verification

$ cargo +stable fmt --all -- --check                                  # passed
$ cargo +stable clippy --workspace --all-targets --locked -- -D warnings   # passed
$ cargo +stable test --workspace --locked                             # nine test binaries, all passed
$ cargo +stable build --workspace --locked                            # target/debug/sqlx reports 0.1.7
$ python3 tests/distribution.py tests/installers.py tests/ui_lifecycle.py \
    tests/ui_distribution.py tests/ui_plugins.py                      # passed
$ python3 tests/updates.py                                            # passed with CURRENT 0.1.7 / NEXT 0.1.8
$ npm --prefix packages/npm-installer test                            # 22 passed, 0 failed
$ mvn -B -f java/jdbc/pom.xml verify                                  # BUILD SUCCESS

git grep '0\.1\.6' leaves only the release-notes changelog link, the third-party entries in Cargo.lock, and version strings inside test fixtures.

Risks and limits

• Nothing is published here. After the merge: annotated tag v0.1.7 on the merge commit, then gh workflow run packages.yml --ref v0.1.7 -f publish=true.
• The npm job publishes with the repository NPM_TOKEN, which expires 2026-12-17; npm ends bypass-2FA direct publishing in January 2027, so the job needs trusted publishing before then.
• The local page plugin is unchanged and keeps its 0.1.4 requirement, so ui-default-0.1.4.zip is still the plugin asset.