fix(release): strip Mach-O with the tool that can actually do it

The previous change generalised `--strip-all` to every platform. Apple's strip
does not accept that flag, so the macOS build failed outright -- loudly, which
was the lucky outcome.

The unlucky version was already in the tree before that: `strip -x`. It succeeds
and leaves 4058 symbols, which is precisely the state VirusTotal flagged on
darwin-arm64 while the fully stripped ELF legs came back clean. Measured on that
artifact:

  llvm-strip --strip-all   373 symbols   CLEAN
  strip        (no flags)  378 symbols   equivalent
  strip -x -S             4058 symbols   the FLAGGED state
  strip -X / -u -r        4058 symbols   likewise

So the flags are chosen per format, and a candidate that cannot do the job is a
hard error rather than a silent fallback to a weaker strip. Verified on a PATH
without llvm-strip, exactly as the runner has it: 373 symbols, codesign --verify
--strict passes, the binary runs.

Packaged and scanned before merge: darwin-arm64 0/60 and ui-darwin-arm64 0/61,
both CLEAN -- the platform that was flagged on the previous release run.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

scripts/package-release.sh

@@ -113,21 +113,31 @@ NAME="codebase-memory-mcp${SUFFIX}-${GOOS}-${GOARCH}"
 strip_release_binary() {
     local binary="$1"
     [ -f "$binary" ] || return 0
-    # --strip-all on every format, Mach-O included.
+    # The right flags differ per format, and the WRONG ones fail silently in
+    # the dangerous direction. Measured on the flagged darwin-arm64 artifact:
     #
-    # This first shipped as `strip -x` on Mach-O out of caution that a full
-    # strip could leave an image dyld will not load. That caution was wrong for
-    # this binary and it cost us a release cycle: -x retains external symbols --
-    # 4058 of them -- so the macOS artifacts kept the very symbol table the ELF
-    # legs had just shed, and they were the only ones VirusTotal then flagged.
-    # Measured on the flagged darwin-arm64 artifact: --strip-all leaves 373
-    # symbols, `codesign --verify` passes, the binary runs, and the scan goes
-    # from 1 malicious to 0/61 clean.
+    #   llvm-strip --strip-all   373 symbols   scanned CLEAN
+    #   strip        (no flags)  378 symbols   equivalent
+    #   strip -x -S             4058 symbols   the state VirusTotal FLAGGED
+    #   strip -X / -u -r        4058 symbols   likewise
+    #
+    # Apple's strip returns success for `-x -S`, so a helper that just tries
+    # candidates until one exits 0 would quietly reship the flagged binary.
+    # GNU/LLVM `--strip-all` is not even accepted by Apple's strip, which is why
+    # generalising it to every platform broke the macOS build -- loudly, which
+    # was the lucky outcome.
+    #
+    # So: --strip-all where it is understood, plain `strip` for Mach-O, and a
+    # hard error when no candidate can do the job. Never a weaker fallback.
     local stripped=""
     for tool in "${STRIP:-}" llvm-strip strip; do
         [ -n "$tool" ] || continue
         command -v "$tool" >/dev/null 2>&1 || continue
-        "$tool" --strip-all "$binary" 2>/dev/null && stripped="$tool"
+        if "$tool" --strip-all "$binary" 2>/dev/null; then
+            stripped="$tool --strip-all"
+        elif [ "$GOOS" = "darwin" ] && "$tool" "$binary" 2>/dev/null; then
+            stripped="$tool"
+        fi
         [ -n "$stripped" ] && break
     done
     if [ -z "$stripped" ]; then