fix(hsm-emulator): install.sh builds and validates the ReleaseSafe artifact

build_module printed (ReleaseSafe) but ran plain 'zig build', which is Debug here (preferred_optimize_mode only ships ReleaseSafe with --release). It left a 20M Debug .so labeled as the shipped build, and 'zig build smoke' would reinstall Debug over any ReleaseSafe artifact via its install-step dependency.

Run build + test + smoke with --release=safe so the script produces and validates the real 5.9M shipped artifact end to end. Kept check-only (no dependency auto-install): missing deps still hard-fail/warn with the exact apt command.

Verified: ./install.sh exits 0 on a clean tree, final zig-out/lib/libhsm.so is 5.9M ReleaseSafe, tests + smoke pass, pkcs11-tool loads it.

PROJECTS/advanced/hsm-emulator/install.sh

@@ -81,7 +81,7 @@ check_just() {
 
 build_module() {
     info "Building the Cryptoki module (ReleaseSafe)..."
-    zig build
+    zig build --release=safe
     local so
     so=$(find zig-out/lib -name 'libhsm.so.*' -type f | head -1)
     [ -n "$so" ] || fail "Build produced no libhsm.so"
@@ -90,14 +90,14 @@ build_module() {
 
 run_tests() {
     info "Running ABI cross-check and unit tests..."
-    if zig build test >/dev/null 2>&1; then
+    if zig build test --release=safe >/dev/null 2>&1; then
         ok "All tests passed (ck.zig matches OASIS v2.40 headers)"
     else
         fail "Tests failed. Run 'zig build test --summary all' for details."
     fi
 
     info "Running the dlopen smoke test..."
-    if zig build smoke 2>&1 | grep -q "smoke: OK"; then
+    if zig build smoke --release=safe 2>&1 | grep -q "smoke: OK"; then
         ok "Smoke test passed (module loads and drives the ABI)"
     else
         fail "Smoke test failed. Run 'zig build smoke' for details."