fix(release): strip shipped binaries

Release binaries carried their full symbol table. Production compiles without
-g, but the linker keeps .symtab regardless, so every archive shipped ~536 KB of
internal function names that nothing needs: a bigger download and a free map of
the internals, by accident rather than by decision. Nothing symbolizes at
runtime -- mem_profile.c is not in the production build and never calls
backtrace_symbols -- so no diagnostics are lost.

It also had a concrete cost. Microsoft's ML scored the unstripped linux-amd64
binary Trojan:Script/Wacatac.B!ml (1 engine of 62) and blocked release run
30398064336 at the VirusTotal gate.

That verdict is a decision-boundary artifact, not a property of the code, and
the evidence is unambiguous:

  * the dry-run build two days earlier (d587dea) is the same program 10 KB
    larger and scans CLEAN -- a 0.003% delta flips the verdict
  * the delta in that window is almost entirely DELETION of Windows-only files
    that Linux never compiled
  * the ui build of the same commit was never flagged
  * two independently flagged builds drew different sub-variants (Wacatac.B and
    Wacatac.C), which a real signature does not do
  * v0.9.0, re-analysed against the same engine build, is still clean -- so this
    is not model drift either

Stripping removes the symbol-name feature surface those models score. It cleared
BOTH flagged builds, and every other platform stays clean, so this fixes Linux
without trading the problem sideways. Verified before merge:

  linux-amd64 (f440743) stripped      0 malicious / 62 engines
  linux-amd64 (0802689) stripped      0 malicious / 62 engines
  linux-arm64 stripped                0 malicious / 61 engines
  linux-amd64-portable stripped       0 malicious / 62 engines
  windows-amd64 stripped              0 malicious / 68 engines
  darwin-arm64 stripped + re-signed   0 malicious / 60 engines

macOS needs care and gets it. The build workflow ad-hoc signs BEFORE this script
runs, so stripping invalidates that signature and the kernel then refuses to
exec the image; Mach-O is re-signed here. It also uses `strip -x` rather than
--strip-all, because a full strip can leave an image dyld will not load. The
packaged macOS binary verifies (`valid on disk`, `satisfies its Designated
Requirement`) and runs, and the full macOS smoke passes against a stripped,
re-signed binary.

Build fingerprints are derived from the file itself during execution, with
nothing embedded during compilation, so staged and target agree and activation
is unaffected.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

Author: DeusData

scripts/package-release.sh

@@ -91,6 +91,53 @@ BUILD_DIR="${BUILD_DIR:-build/c}"
 OUT_DIR="$(mkdir -p "$OUT_DIR" && cd "$OUT_DIR" && pwd)"
 NAME="codebase-memory-mcp${SUFFIX}-${GOOS}-${GOARCH}"
 
+# Ship every release binary stripped. Production already builds without -g, but
+# the linker still keeps a ~536 KB .symtab, so releases carried their full
+# symbol table to users: bigger downloads and a free map of the internals, with
+# nothing gained. Nothing symbolizes at runtime (mem_profile.c is not in the
+# production build and never calls backtrace_symbols), so this costs no
+# diagnostics.
+#
+# It also had a concrete cost. Microsoft's ML scored the unstripped linux-amd64
+# binary Trojan:Script/Wacatac.B!ml (1 engine of 62) and blocked release run
+# 30398064336 at the VirusTotal gate. That verdict is a decision-boundary
+# artifact rather than a property of the code -- the dry-run build two days
+# earlier is the same program plus 10 KB and scans clean, and the ui build of
+# the same commit was never flagged. Stripping removes the symbol surface those
+# models score and cleared BOTH flagged builds (Wacatac.B and Wacatac.C)
+# without changing what the program does.
+#
+# macOS is ad-hoc signed by the build workflow BEFORE this script runs, and
+# stripping invalidates that signature, so Mach-O is re-signed here. Skipping
+# the re-sign ships a binary the kernel refuses to exec.
+strip_release_binary() {
+    local binary="$1"
+    [ -f "$binary" ] || return 0
+    local stripped=""
+    for tool in "${STRIP:-}" llvm-strip strip; do
+        [ -n "$tool" ] || continue
+        command -v "$tool" >/dev/null 2>&1 || continue
+        if [ "$GOOS" = "darwin" ]; then
+            # -x keeps external symbols: a full strip of a Mach-O can leave an
+            # image dyld will not load.
+            "$tool" -x "$binary" 2>/dev/null && stripped="$tool"
+        else
+            "$tool" --strip-all "$binary" 2>/dev/null && stripped="$tool"
+        fi
+        [ -n "$stripped" ] && break
+    done
+    if [ -z "$stripped" ]; then
+        echo "package-release: no working strip for $binary" >&2
+        return 1
+    fi
+    if [ "$GOOS" = "darwin" ]; then
+        command -v codesign >/dev/null 2>&1 &&
+            codesign --sign - --force "$binary" 2>/dev/null
+    fi
+    echo "=== package-release: stripped $(basename "$binary") ==="
+    return 0
+}
+
 if [ "$GOOS" = "windows" ]; then
     # Windows ships ONE binary, exactly like every other platform. There is no
     # launcher stub: a small unsigned PE whose entire job is to verify and
@@ -107,6 +154,7 @@ if [ "$GOOS" = "windows" ]; then
     PACK_DIR="$(mktemp -d "${TMPDIR:-/tmp}/cbm-package.XXXXXX")"
     trap 'rm -rf "$PACK_DIR"' EXIT
     cp "$PAYLOAD" "$PACK_DIR/codebase-memory-mcp.exe"
+    strip_release_binary "$PACK_DIR/codebase-memory-mcp.exe" || exit 2
     cp LICENSE install.ps1 "$PACK_DIR/"
     scripts/gen-third-party-notices.sh "$PACK_DIR/THIRD_PARTY_NOTICES.md"
     (
@@ -119,6 +167,7 @@ if [ "$GOOS" = "windows" ]; then
 else
     [ -f "$BUILD_DIR/codebase-memory-mcp" ] ||
         { echo "package-release: build first; missing $BUILD_DIR/codebase-memory-mcp" >&2; exit 2; }
+    strip_release_binary "$BUILD_DIR/codebase-memory-mcp" || exit 2
     cp LICENSE install.sh "$BUILD_DIR/"
     scripts/gen-third-party-notices.sh "$BUILD_DIR/THIRD_PARTY_NOTICES.md"
     tar -czf "$OUT_DIR/$NAME.tar.gz" -C "$BUILD_DIR" \