fix(dist): verify release artifact builds

.github/workflows/ci.yml

@@ -39,6 +39,8 @@ jobs:
         run: cargo install cargo-dist --version 0.32.0 --locked
       - name: Validate configuration-only cargo-dist manifest
         run: dist manifest --artifacts=local --output-format=json --no-local-paths
+      - name: Build cargo-dist host artifacts
+        run: dist build --artifacts=host
       - name: Build release
         run: cargo build --release
       - name: Full-pack smoke test (stdio MCP)

CHANGELOG.md

@@ -49,3 +49,5 @@ All notable changes to ReasonKit Think are documented here.
 - Added deterministic protocol, pack, eight-check adversarial governance,
   packaging, Registry, cargo-dist, and dependency-audit gates for CI and local
   release checks.
+- Added the cargo-dist release profile and a real host-artifact build gate so
+  distribution validation cannot pass while archive production is broken.

Cargo.toml

@@ -46,3 +46,7 @@ reqwest = { version = "0.12", default-features = false, features = ["blocking",
 
 [dev-dependencies]
 uuid = { version = "1", features = ["v4"] }
+
+[profile.dist]
+inherits = "release"
+lto = "thin"

justfile

@@ -31,7 +31,10 @@ dist-check:
     @test "$(dist --version)" = "cargo-dist 0.32.0"
     @dist manifest --artifacts=local --output-format=json --no-local-paths > /dev/null
 
-ci: check eval audit package-check registry-check dist-check
+dist-host-check: dist-check
+    dist build --artifacts=host
+
+ci: check eval audit package-check registry-check dist-check dist-host-check
 
 fmt:
     CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-{{ justfile_directory() }}/target}" cargo fmt

tests/test_distribution_docs.py

@@ -142,6 +142,22 @@ def test_cargo_dist_bootstrap_is_config_only(self) -> None:
         self.assertEqual(config["dist"]["hosting"], ["github"])
         self.assertFalse((ROOT / ".github" / "workflows" / "release.yml").exists())
 
+    def test_cargo_dist_has_a_buildable_release_profile_and_host_gate(self) -> None:
+        cargo = tomllib.loads((ROOT / "Cargo.toml").read_text(encoding="utf-8"))
+        self.assertEqual(
+            cargo["profile"]["dist"],
+            {"inherits": "release", "lto": "thin"},
+        )
+
+        justfile = (ROOT / "justfile").read_text(encoding="utf-8")
+        self.assertIn("dist-host-check:", justfile)
+        self.assertIn("dist build --artifacts=host", justfile)
+
+        workflow = (ROOT / ".github" / "workflows" / "ci.yml").read_text(
+            encoding="utf-8"
+        )
+        self.assertIn("dist build --artifacts=host", workflow)
+
     @unittest.skipUnless(shutil.which("dist"), "cargo-dist is not installed")
     def test_cargo_dist_manifest_needs_no_generated_workflow(self) -> None:
         result = subprocess.run(