fix(release): strip shipped binaries

[DeusData]

Release run 30398064336 was blocked at the VirusTotal gate: Microsoft's ML
scored the unstripped linux-amd64 binary Trojan:Script/Wacatac.B!ml
(1 engine of 62). Everything else in that run passed -- full test matrix, build,
soak, and all six Windows smoke jobs.

The detection is a decision boundary, not our code

• the dry-run build two days earlier (d587dea) is the same program 10 KB
  larger and scans CLEAN -- a 0.003% delta flips the verdict
• the change in that window is almost entirely deletion of Windows-only
  files that Linux never compiled
• the ui build of the same commit was never flagged
• the two flagged builds drew different sub-variants (Wacatac.B and
  Wacatac.C) -- a real signature does not wander
• v0.9.0 re-analysed against the same engine build is still clean, so this
  is not model drift either

The fix stands on its own merits

We were shipping unstripped binaries. Production compiles without -g, but the
linker keeps .symtab regardless, so every release carried ~536 KB of internal
function names: a bigger download and a free map of the internals, by accident
rather than by decision. Nothing symbolizes at runtime (mem_profile.c is not
in the production build and never calls backtrace_symbols), so no diagnostics
are lost.

Stripping removes the symbol-name feature surface these models score.

Verified before merge, all platforms

Artifact	Engines	Verdict
linux-amd64 (f440743) stripped	62	CLEAN
linux-amd64 (0802689) stripped	62	CLEAN
linux-arm64 stripped	61	CLEAN
linux-amd64-portable stripped	62	CLEAN
windows-amd64 stripped	68	CLEAN
darwin-arm64 stripped + re-signed	60	CLEAN

Both flagged builds cleared, and the four already-clean platforms stayed clean --
so this fixes Linux without trading the problem sideways.

macOS

The build workflow ad-hoc signs before this script runs, so stripping
invalidates that signature and the kernel then refuses to exec the image. Mach-O
is re-signed here, and uses strip -x rather than --strip-all because a full
strip can leave an image dyld will not load. Verified: packaged binary reports
valid on disk / satisfies its Designated Requirement, runs, and the full
macOS smoke passes against a stripped, re-signed binary.

Build fingerprints are derived from the file during execution with nothing
embedded during compilation, so staged and target agree and activation is
unaffected.