Release checklist for a closed-source Linux CLI binary: strip paths, debug info, ident

To ship a C/C++ tool as a binary while keeping its source private, the binary still leaks a lot by default: DWARF debug info, absolute source paths in __FILE__ and assert strings, the GCC version in .comment, and a build-id. Build with -g0 -ffile-prefix-map=$PWD=. -fno-ident and link with -Wl,--build-id=none. Then strip --strip-all, which also removes .symtab. Use static libstdc++/zstd on an old-glibc baseline, or musl, so it runs on old enterprise Linux. Gate every release on: readelf -S showing no .debug*, .symtab or .comment; readelf -d NEEDED limited to libc/libm/libpthread; strings checked against a deny-list (your paths, hostnames, internal names); two clean builds giving the same sha256; and the functional/parity test run on that exact stripped binary, not on the debug build.