Enable supported release hardening options

[Copilot]

• Review new PR feedback and locate affected release workflow step
• Add pipefail to the Build Release run block before the ninja pipeline
• Run targeted workflow/script formatting checks
• Run final validation and reply to PR comment

[achamayou]

@copilot please enable this CMake flag in the release pipeline, and where the option is defined in CMake, add a comment paragraph describing the various options, a summary of their effect, and a link to their documentation page, wherever it lives.

[Copilot]

@copilot please enable this CMake flag in the release pipeline, and where the option is defined in CMake, add a comment paragraph describing the various options, a summary of their effect, and a link ...

Addressed in 66512af: the release and RPM reproduction CMake invocations now explicitly set CCF_ENABLE_RELEASE_HARDENING=ON, and the CMake option has a documentation comment covering the hardening flags and references.

[Copilot]

Pull request overview

This PR introduces an opt-in (default ON) CMake toggle to apply supported compiler/linker hardening flags to optimized “release” configurations, and ensures the release/repro pipelines explicitly enable it for reproducible packaging.

Changes:

• Adds CCF_ENABLE_RELEASE_HARDENING (default ON) and conditionally enables supported hardening compile/link options for Release, RelWithDebInfo, and MinSizeRel.
• Updates the release GitHub Actions workflow and RPM reproduction script to explicitly set -DCCF_ENABLE_RELEASE_HARDENING=ON for Release builds.
• Improves RPM reproduction script robustness by enabling pipefail.

Custom instructions used:

• .github/copilot-instructions.md
• .github/instructions/reviewing.instructions.md

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
reproduce/reproduce_rpm.sh	Enables pipefail and explicitly turns on release hardening during RPM reproduction builds.
CMakeLists.txt	Adds CCF_ENABLE_RELEASE_HARDENING and applies supported hardening flags via CMake feature checks for release configurations.
.github/workflows/release.yml	Explicitly enables release hardening in the release build and RPM packaging workflow.

[achamayou]

@copilot fix it

[Copilot]

Fixed in 9e6c768 by adding set -o pipefail before the ninja -v | tee build.log pipeline in the release build step.