Apply the link-time Identical Code Folding optimization from
[deno#34478](denoland/deno#34478) where it
actually fits node-smol's toolchain.

ICF folds byte-identical functions at link time. Deno measured ~4.4% on
a Rust binary via lld --icf=safe; the technique is linker-level, so it
ports to node-smol's C++ output. Mapping it to the real per-platform
linkers:

- Windows (MSVC link.exe): set OptimizeReferences + EnableCOMDATFolding
  (/OPT:REF + /OPT:ICF) on the Release VCLinkerTool. Release implies these
  already; making them explicit keeps the behavior durable, matching the
  durability fix Deno made for its MSVC path. Debug keeps incremental
  linking untouched.
- macOS (ld64/ld-prime): already folds in release; no flag needed.
- Linux (bfd ld): node-smol never selects gold or lld, and bfd has no
  ICF. Getting it there needs a linker switch, deferred pending a
  measurement that justifies the toolchain risk.

Assessment + measurement recipe documented in
packages/node-smol-builder/docs/binary-size-icf.md.

Inspired by denoland/deno#34478

Use `--icf=safe` for optimized macOS release artifacts, via Rust's
bundled Mach-O LLD.

Measurements showed useful size wins on macOS; Linux did not show a
meaningful artifact-size improvement and are excluded here. See
#19615 (comment)

…#34478)

Enables **safe identical code folding (ICF)** at link time across
platforms. Rust emits a large number of identical machine-code functions
(monomorphized `drop` glue, `Debug` impls, closures, generic
instantiations); folding the identical copies shrinks the binary and
lowers resident memory.

### What

- **macOS (aarch64 + x86_64)** and **Linux (x86_64 + aarch64)**: `lld
--icf=safe`
- mac via `.cargo/config.toml`; Linux via the CI
`RUSTFLAGS`/`RUSTDOCFLAGS` in `ci.ts` (CI sets `RUSTFLAGS`, which
overrides `config.toml`, and guarantees `lld`)
- **Windows (MSVC)**: `/OPT:ICF`, scoped to non-debug builds (rustc
already enables `/OPT:REF,ICF` for optimized builds; set explicitly to
make it durable)

`--icf=safe` only folds functions whose addresses are *not* significant
(via address-significance tables), so function-pointer identity is
preserved — unlike `--icf=all`.

### Numbers (measured on `aarch64-apple-darwin`, `release` profile)

| metric | before | after | Δ |
|---|---|---|---|
| stripped binary (`strip -x -S`) | 84.83 MB | 78.84 MB | **−5.99 MB
(−7.0%)** |
| `__TEXT` segment | 80.6 MB | 74.7 MB | −6.2 MB |
| idle RSS (`Deno.serve` idle, median of 6) | ~60.6 MB | ~54.6 MB |
**−6.0 MB (~10%)** |

Idle RSS measured via `Deno.memoryUsage().rss` after a 1s settle;
spreads were tight (±0.3 MB), so the delta is well clear of noise.

### Notes

- Numbers above are arm64 macOS. The same mechanism applies on the other
platforms; exact savings will vary (fat-LTO/CGU=1 release already folds
some duplicates, but ICF still folds more — the win held and even grew
vs. `release-lite` in testing).