ANW-34 CI: gzip + strip release binaries

ap keeps every release and the raw, unstripped binaries are the bulk of
that storage. Strip symbols via the release profile and gzip -9 each
asset before upload (~2.7x smaller); the publish job and Forgejo
mirror-back pass the .gz assets through unchanged.

Assumed .gz per binary over .tar.gz -- the assets are single files, so a
tarball only adds a directory layer. Flag if a bundle (LICENSE/README) is
wanted. E2E needs a release run; piggyback on the next real tag.

Cargo.toml

@@ -34,6 +34,11 @@ walkdir = "2"
 [dev-dependencies]
 tempfile = "3"
 
+# Strip symbols from release binaries: smaller artifacts for the release
+# pipeline (assets are also gzipped there) and for local release builds.
+[profile.release]
+strip = true
+
 [lints.rust]
 unsafe_code = "forbid"