docs(releases): name the stored-metadata pass on the v17 page (#4327)

The v17 entry for #3903 described the read-path guarantee and stopped there,
and the upgrade checklist listed the two per-deployment migrations without
this one. Both now point at `os migrate meta --stored`, marked optional —
it opens no gate, unlike its two neighbours in that list.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WoZPKPDqJ7WB7z84xk9y3f

Author: claude

content/docs/releases/v17.mdx

@@ -1672,7 +1672,12 @@ platform capabilities an administrator gains, then the Console delta.
   source at every read seam (including `registerFlow` rehydration) — a stored
   action with the removed `execute` dispatches via `target` again; boot
   hydration validates each row post-conversion and diagnoses invalid ones
-  with `[metadata_spec_invalid]` instead of shrugging.
+  with `[metadata_spec_invalid]` instead of shrugging. **The rows themselves
+  can now be brought forward too (#4327):** `os migrate meta --stored`
+  replays the chain over `sys_metadata` and rewrites what still carries a
+  pre-protocol shape, through the normal write path. Optional — the read path
+  is the guarantee either way — but it is what makes the conversion pass a
+  no-op on your data instead of a permanent shim.
 - **Studio's metadata forms tell the truth (#3786).** Four of seventeen forms
   had drifted from their schemas, so controls saved nothing: the Object →
   Capabilities toggles bound a key the schema does not declare (all seven
@@ -1977,6 +1982,12 @@ covers are folded into the list below rather than left to the changelog.)
   fix what it reports before `--apply`. It converts nothing — the values it
   names are application data — and a scan that was truncated or could not read
   an object fails the gate even at zero violations.
+- **Stored metadata (optional):** run `os migrate meta --stored` to see which
+  `sys_metadata` rows still carry a pre-17 shape, and `--apply` to rewrite
+  them. Unlike the two above this opens no gate and nothing depends on it —
+  those rows already read canonically, forever. It stops them re-converting on
+  every load, keeps diffs and exports clean going forward, and gives you an
+  exit code to assert on: nothing left to do exits `0`.
 - **Datasources:** verify every declared datasource connects in every
   environment — a bound datasource that cannot connect now fails the boot
   instead of failing every later query.