build(release): UPX Linux envc binaries and trim link metadata

Use GoReleaser UPX (linux only, best+lzma), install upx-ucl in the tag release workflow, and add -buildvcs=false with empty -buildid=. Stop Dependabot auto bump PRs via open-pull-requests-limit 0. Remove stray LibreOffice lock file under docs.

Co-authored-by: Cursor <cursoragent@cursor.com>

.goreleaser.yml

@@ -25,12 +25,22 @@ builds:
         goarch: arm64
     flags:
       - -trimpath
+      - -buildvcs=false
     ldflags:
-      - -s -w
+      - -s -w -buildid=
       - -X main.version={{.Version}}
       - -X main.commit={{.Commit}}
       - -X main.date={{.Date}}
 
+# Linux only: UPX shrinks ELF; skip darwin/windows (signing / compatibility).
+# See https://goreleaser.com/customization/builds/upx/
+upx:
+  - enabled: true
+    ids: [envc]
+    goos: [linux]
+    compress: best
+    lzma: true
+
 archives:
   - id: envc
     ids: [envc]