[OC-066] Enforce the installed binary size budget

[tcballard]

Gate: G5 — tiny release artifacts

Product constraint: OmaChat is a text client for Omarchy hosts, not an application bundle that should carry hundreds of megabytes of runtime/build output. Cargo build caches are not installed product size.

---

• Depends on: OC-002, OC-061.
• Deliverable: a size-optimized Rust release profile and a CI check that measures the three installed executables (omachat, omachat-ctl, and omachatd) with an aggregate 10 MiB hard ceiling.
• Acceptance: the pinned Linux release build emits stripped binaries, CI prints each executable and aggregate byte count, a missing binary or exceeded ceiling fails, and packaging continues to install only the intended executables/assets rather than Cargo targets or build caches.
• Current measured baseline: approximately 3.77 MiB aggregate before the persistent-account/registry slice; the ceiling is a guardrail, not a target.
• Excludes: Cargo target-directory size, debug/test artifacts, shared system-library disk usage, package-compression claims, AUR publication, and runtime memory/soak evidence tracked by OC-064.

Closure evidence — 2026-09-04

Implemented on main at 87c3bcb7d65e3e2ab8ae317694b751f8efe9a8ed (merged #222 tree).

• Successful pinned CI runs the release build, guard regression tests, actual size guard and packaging validation.
• Size guard prints each of the three installed executables and their aggregate bytes; missing/non-executable files and an aggregate above 10 MiB fail.
• Regression tests, release profile and packaging checks enforce the contract.

This closes the automated installed-size guard only. Target-host packaging acceptance, runtime resource/soak evidence, release tagging and publication remain separate open gates.