The workspace had `[profile.dev]` and `[profile.test]` but nothing for `[profile.release]`, so the shipped binary got no LTO, default codegen units and no symbol stripping. `overflow-checks` stays on past the profile's usual default of off, because the CBOR, CAR and WAL frame parsers do length and offset arithmetic on bytes read straight off the network, and a silent wraparound there is a correctness bug. Change-Id: I7227147df17a0fe9250e9eb304b1144b678ac539