[swananan]

Enable Fat LTO in the workspace release profile so local release builds, CI release builds, runtime performance checks, and packaged releases use the same LTO setting. Debug and standard e2e profiles remain unchanged.

Refresh futures-util and its required futures dependencies from 0.3.31 to 0.3.34 in Cargo.lock. This removes pin-utils and fixes the RustSec unmaintained warning RUSTSEC-2026-0441 without changing advisory policy or adding an exception.

Local Fat LTO measurements reduced the GhostScope binary from 56.82 MiB to 41.98 MiB; two DWARF samples improved by approximately 3–4%, with a longer clean build. These are sample measurements on a host with background load, not end-to-end tracing results.

Validation:

• On current head caf0a90: cargo audit --deny warnings and cargo deny check advisories bans licenses sources passed using the same tool versions as CI. Deny retains existing non-blocking warnings.
• Full-workspace Clippy with all targets/features and CI warning flags passed; 824 workspace library tests passed. Library tests used an isolated target directory after the existing target directory hit a permissions error.
• On the preceding LTO-only commit 1a7e3db: release build/package/install/tracing smoke, standard/ARM64/container e2e, and both performance workflows passed. CI Build took 5m41s, Release Build 5m05s, and the longest e2e 24m02s. Runtime slowdown changes were within ±0.25%, with no missing events and 2.42–5.26% lower peak RSS.
• On current head caf0a90, both GitHub Actions Supply Chain jobs passed: https://github.com/swananan/ghostscope/actions/runs/42250017198. Other CI workflows are still running. Local standard/container e2e were not duplicated; the new CI run covers them.