Test production ThinLTO binaries in one build

[helly25]

Default Linux and macOS tests now build and test everything once using the same Clang, size optimization, ThinLTO, and linker settings as published binaries. This removes the duplicate release build while keeping smoke coverage of the final stripped artifacts.

AG;DR

Configuration

• Split compiler selection from release optimization: --config=release is now an independent optimization/link layer.
• Add --config=clang_release, which composes --config=clang --config=release without duplicate expansion warnings.
• Use --config=clang_release for default CI tests and release publication builds and queries.
• Preserve the existing default job names and cache keys, allowing the production-config build to inherit the established cache lifecycle.

CI and release validation

• Run the complete core and extras suite in one Bazel invocation per default platform cell.
• Remove the second release-only bazel test and both subsequent bazel build invocations.
• Stage bazel-bin/xff/cli/xff and bazel-bin/xff/cli/xff_full, which the complete suite already builds through its binary-level tests.
• Continue executing the staged, stripped lean and full binaries and uploading both raw executables and debug archives.
• Strengthen release_prep_test.sh to reject reintroduction of release-only Bazel test/build phases and require staging from the outputs of the complete test invocation.

Measured basis

The timing experiment used a fresh ThinLTO cache while the existing opt jobs restored their established primary caches. Even with that disadvantage, the complete ThinLTO test command took 15m25s on Linux versus 15m42s for opt, and 17m29s on macOS versus 14m58s for opt. This keeps wall time comparable while substantially reducing total runner and compilation cost and testing the production configuration directly.

Validation

• bazel test //... $(tools/extras.py --wildcards) --config=xff_docs --config=clang_release (181/181 tests passed)
• tools/release_prep_test.sh
• git diff --check origin/main...HEAD
• pre-commit run --files .bazelrc .github/workflows/main.yml .github/workflows/release.yml README.md docs/history.md tools/release_prep_test.sh xff/BUILD.bazel

The branch is based directly on current origin/main (f69cb7bff).