rules: build-artifact hygiene, attestation gates, and stale-artifact pruning

rules/common/docs-and-tests.md

@@ -60,6 +60,22 @@
 - Repository-local policy may require stricter local validation for a specific
   project or change class. Such overrides should explain why hosted CI alone is
   insufficient for that risk.
+- Default build profiles should not carry full debug information. Keep the
+  default local and release profiles lean; provide an opt-in profile variant
+  (or a documented one-command override) for the sessions that actually attach
+  a debugger. Line-table-only debug information is usually enough for readable
+  backtraces at a fraction of the size. CI profiles used for comprehensive
+  runs should strip symbols.
+- When hosted CI owns the measurement for a gate (coverage is the canonical
+  case), the local pre-PR gate may be attestation-based: an explicit flag or
+  statement that the changed code was reviewed for that property. The
+  attestation must be explicit and the check must fail when it is absent;
+  silence is not attestation.
+- Build directories accumulate stale artifacts that no setting prevents:
+  dependency version and feature churn leaves orphaned object files behind.
+  Repositories should document a pruning mechanism (an age-based sweep tool or
+  a periodic full clean) and agents should propose a cleanup when a build
+  directory's size is clearly dominated by artifacts no current build uses.
 
 ## Benchmarks
 

rules/rust/performance.md

@@ -46,6 +46,24 @@
 - Prefer structural cache keys and exact equality checks over formatting whole
   programs into strings on every lookup.
 
+## Build Profiles And Target Hygiene
+
+- Default `[profile.dev]` and `[profile.test]` should set `debug = 0` while
+  keeping `debug-assertions` and `overflow-checks` enabled, and keep
+  incremental compilation on for edit-test loops. Provide a one-command
+  override (for example `CARGO_PROFILE_DEV_DEBUG=1`) or an opt-in profile for
+  debugger sessions.
+- `[profile.release] debug = true` in a workspace whose normal verification
+  runs in release mode multiplies the build directory by gigabytes. Prefer
+  `debug = "line-tables-only"` for readable backtraces, with a separate
+  `release-debug` inheriting profile for full debugger information.
+- The profile used by comprehensive CI runs should disable incremental
+  compilation and set `strip = "symbols"`.
+- Dependency `rev =` bumps and feature churn leave orphaned rlibs and test
+  binaries in `target/` that no profile setting removes. Document the pruning
+  mechanism (an age-based sweep tool, or a periodic `cargo clean`), and
+  propose a cleanup when `target/` growth is dominated by stale artifacts.
+
 ## GPU Kernels
 
 - Launch domains should cover the output or update domain. Avoid