perf(pm): shrink binary 10MB→6.4MB — system git, single TLS provider, drop hickory/h2

.github/workflows/pm-binary-size.yml

@@ -0,0 +1,73 @@
+name: utoopm-binary-size
+
+# Reports the release `utoo` binary size on Linux + macOS and asserts that the
+# trimmed dependency set (no aws-lc-rs, no hickory) holds. Lets a size-focused
+# PR show the real shipped-artifact size on both platforms, since local builds
+# are usually one arch only. Manual + on PRs that touch the relevant crates.
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - "crates/pm/**"
+      - "crates/ruborist/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+      - ".github/workflows/pm-binary-size.yml"
+
+jobs:
+  size:
+    name: ${{ matrix.target }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+          - os: macos-latest
+            target: aarch64-apple-darwin
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: nightly-2026-04-02
+          targets: ${{ matrix.target }}
+
+      - name: Init git submodules
+        run: git submodule update --init --recursive --depth 1
+
+      - name: Build release binary
+        run: cargo build --release --bin utoo --target ${{ matrix.target }} -p utoo-pm
+
+      - name: Report size
+        run: |
+          BIN="target/${{ matrix.target }}/release/utoo"
+          echo "## utoo release binary — ${{ matrix.target }}" >> "$GITHUB_STEP_SUMMARY"
+          ls -lh "$BIN"
+          BYTES=$(wc -c < "$BIN")
+          echo "- size: **$(numfmt --to=iec "$BYTES" 2>/dev/null || echo "$BYTES bytes")** ($BYTES bytes)" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Assert trimmed dependency set
+        run: |
+          # None of these may be linked into the production (non-dev) binary:
+          #   aws-lc-sys      second crypto backend (unified to ring)
+          #   hickory-*       DNS resolver (replaced by custom getaddrinfo)
+          #   gix/gix-*       bundled git (replaced by system `git`)
+          #   h2              HTTP/2 (clients force h1; gix-transport was the
+          #                   only non-dev puller)
+          fail=0
+          for crate in aws-lc-sys hickory-resolver hickory-proto gix gix-transport h2; do
+            if cargo tree -p utoo-pm --target ${{ matrix.target }} -e no-dev -i "$crate" >/dev/null 2>&1; then
+              echo "::error::$crate is still linked into the release binary — trimming regressed"
+              fail=1
+            else
+              echo "ok: $crate absent"
+            fi
+          done
+          # ring must be the sole TLS provider.
+          cargo tree -p utoo-pm --target ${{ matrix.target }} -i ring >/dev/null 2>&1 \
+            && echo "ok: ring present (sole TLS provider)" \
+            || { echo "::error::ring (TLS provider) missing"; fail=1; }
+          exit $fail