v0.17.0

Added

• Technical-analysis indicators (TA-Lib parity) — 25 curated indicators implemented in
  pure Rust with golden parity against pinned TA-Lib outputs: trend and momentum (rsi,
  macd, stoch, stochf, stochrsi, willr, cci, roc, rocp, rocr, mom,
  ultosc), the directional family (adx, dx, plus_di, minus_di), volatility (atr,
  natr, trange, bbands), and volume (obv, ad, adosc). Wilder smoothing for the
  RSI/ATR/ADX family and population standard deviation for Bollinger bands. A JSON indicator
  registry drives golden generation alongside the Rust and Python parity tests, and
  list_supported() exposes the contract (has_parity marks golden-backed entries). No
  runtime dependency on the TA-Lib C library; the remaining functions are classified and
  explicitly deferred in docs/ta-lib-full-coverage-matrix.md. See
  docs/adr/0005-ta-indicators-scope.md.

• Native ChaCha20 Monte Carlo hot path — the default Python monte_carlo_stock_valuation
  now draws with native Rust ChaCha20 and no NumPy RNG round-trip; the NumPy-bridge path is
  retained as monte_carlo_stock_valuation_parity for frozen audit and CI. Terminal prices
  return zero-copy as a NumPy array, and runs of 50k paths or more parallelise. See
  docs/adr/0007-scenarios-chacha20-hot-path.md.

• Rust Monte Carlo scenarios — Core terminal valuation (simple GBM and advanced
  multi-driver) lives in src/scenarios.rs behind the scenarios feature. The
  Python extension draws with NumPy PCG64 and runs math/stats in Rust for frozen
  parity (rel_tol=1e-9). A native ChaCha20 Rust API is available for Rust-only
  callers. Pure-Python fallback remains for random.Random seeds and no-numpy
  environments. See docs/adr/0006-scenarios-rust-port-rng.md.

• Pure-Python Monte Carlo scenarios — nanobook.scenarios exposes
  monte_carlo_stock_valuation, MonteCarloResult, and helpers with stdlib-only
  runtime (optional numpy acceleration when installed). Includes frozen numpy parity
  fixtures, hypothesis property tests, and an e2e path into backtest_weights.
  See python/examples/scenario_backtest.py.

• IBKR resting STOP / STOP_LIMIT orders — IbkrBroker.submit_order accepts a
  new optional stop_price_cents and routes order_type="stop" / "stop_limit"
  through ibapi's stop / stop_limit order builders (aux_price = stop trigger,
  limit_price = limit for stop-limit). Previously only market/limit were encodable.
  Additive and backward-compatible: existing market/limit calls are unchanged and the
  new parameter is last and optional. Enables broker-resting protective stops.

Security

• Dependency advisories cleared — upgraded pyo3 and numpy 0.27 → 0.29
  (RUSTSEC-2026-0176, out-of-bounds read in PyList/PyTuple nth/nth_back;
  RUSTSEC-2026-0177, missing Sync bound on PyCFunction::new_closure); bumped
  quinn-proto to 0.11.16 (RUSTSEC-2026-0185, remote memory exhaustion) and
  crossbeam-epoch to 0.9.20 (RUSTSEC-2026-0204, invalid pointer dereference).
  The pyo3 bump adds explicit from_py_object opt-in to the Clone-deriving
  #[pyclass] types; behaviour is unchanged. Also cleared the two remaining
  unsoundness advisories by bumping anyhow to 1.0.104 (RUSTSEC-2026-0190,
  Error::downcast_mut) and memmap2 to 0.9.11 (RUSTSEC-2026-0186, unchecked
  pointer offset). cargo audit and cargo deny check are both clean.

Fixed

• Python __version__ drift — the binding hardcoded 0.9.1 while the wheel
  shipped as 0.16.2. It is now taken from the crate manifest via
  env!("CARGO_PKG_VERSION"), and test_version asserts it against the
  installed distribution metadata so the two cannot diverge again.
• CI toolchain and lints — pinned dtolnay/rust-toolchain to the known-good
  stable SHA, applied cargo fmt --all, and resolved clippy -D warnings
  (manual memcpy, range/counter loops) in the indicators module. Bumped the
  pinned GitHub Actions (setup-python, upload-artifact, setup-uv, codecov).