Build signed releases with a dist profile

Cargo.toml gains a dist profile: release with thin LTO over a single codegen unit. scripts/package-native-macos.sh uses it only for a signed production package, so local and unsigned installs stay on release and keep their fast build loop.

On the measured build, napdock-app went from 114.2 MB to 97.2 MB. The cost is about 10 more minutes per production package and a second full build directory, target/dist, on machines that cut a signed release. docs/release.md says which profile each package uses.