fix(build): M-02 — enable overflow checks in release profile

Cargo.toml

@@ -54,3 +54,4 @@ lto = true
 codegen-units = 1
 panic = "unwind"
 strip = true
+overflow-checks = true

tests/integration_test.rs

@@ -1790,3 +1790,20 @@ async fn test_k03_passwd_sheet_remains_valid_and_rekey_revokes_old_sheet() {
     // Aufräumen
     let _ = std::fs::remove_file(&container_path);
 }
+
+#[test]
+fn test_m02_release_profile_enables_overflow_checks() {
+    let cargo_toml = std::fs::read_to_string("Cargo.toml").expect("Read Cargo.toml");
+    let release_section = cargo_toml
+        .split("[profile.release]")
+        .nth(1)
+        .expect("Must have [profile.release] section");
+    let release_block = release_section
+        .split('[')
+        .next()
+        .unwrap_or(release_section);
+    assert!(
+        release_block.contains("overflow-checks = true"),
+        "M-02: [profile.release] must explicitly set overflow-checks = true to prevent integer overflow vulnerabilities"
+    );
+}