fix(build): nescapture's release profile was being ignored

`apps/nescapture/Cargo.toml` carried `[profile.release]` with `opt-level = 3`
and `lto = "thin"`. Cargo only reads `[profile.*]` from the workspace root and
warns about a member that writes one, so `cargo build --release --workspace`
— which is what build/Dockerfile runs — ignored it. The Vulkan capture layer
that ends up in the guest image was built at the default release profile, and
the warning saying so scrolled past on every build.

`opt-level = 3` is already the release default, so `lto = "thin"` is the only
part that was actually lost. It moves to the workspace root, where Cargo
reads it, and now applies to all five members — the same rule as
`[workspace.dependencies]` right above it: what must not differ between
members is stated once.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Cargo.toml

@@ -33,6 +33,19 @@ tokio = { version = "1", features = ["full"] }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 
+# Cargo only reads `[profile.*]` from the workspace root, and warns about a
+# member that writes one. `apps/nescapture` had exactly this block and was
+# getting none of it: `cargo build --release --workspace` — which is what
+# build/Dockerfile runs — silently ignored it, so the Vulkan capture layer
+# shipped at the default release profile.
+#
+# `opt-level = 3` is already the release default; `lto = "thin"` is the part
+# that was actually being lost. It applies to the whole workspace now, which is
+# the same rule as `[workspace.dependencies]` above: settings that must not
+# differ between members live in one place.
+[profile.release]
+lto = "thin"
+
 [workspace.package]
 edition = "2024"
 license = "Apache-2.0"

apps/nescapture/Cargo.toml

@@ -40,6 +40,3 @@ libc = "0.2"
 # Shared IPC protocol
 nesprotocol = { path = "../../crates/nesprotocol" }
 
-[profile.release]
-opt-level = 3
-lto       = "thin"