Production binary/compiler hardening flags + verification lane

[CameronBrooks11]

Add production-grade compiler/binary hardening, kept separate from sanitizer builds, plus a CI lane that verifies the flags are actually present.

Migrated from TODO.md (anolishq/.github#83). Covers:

• Add a hardened "Release-Hardened" preset (separate from sanitizer builds).
• Stack protection for all non-sanitized production builds (-fstack-protector-strong//GS).
• _FORTIFY_SOURCE=2 (or 3 where supported) for release builds on supported platforms.
• PIE for executables for full ASLR (-fPIE + -pie).
• RELRO + immediate binding on ELF (-Wl,-z,relro,-z,now).
• Expand security-specific clang-tidy checks and enforce policy.
• CI lane to verify hardened flags are present in production builds (flag check + checksec on Linux).