ci: audit release flags and dependency pins

.github/workflows/build-check.yml

@@ -28,6 +28,10 @@ jobs:
       - name: Build ${{ matrix.environment }}
         run: pio run -e ${{ matrix.environment }}
 
+      - name: Audit release artifact
+        if: matrix.environment == 'tdeck-release'
+        run: python tools/audit_release_build.py
+
       - name: Upload firmware artifact
         if: matrix.environment == 'tdeck-release'
         uses: actions/upload-artifact@v4

.github/workflows/release-firmware.yml

@@ -33,6 +33,9 @@ jobs:
       - name: Build release-qualified T-Deck firmware
         run: pio run -e tdeck-release
 
+      - name: Audit release artifact
+        run: python tools/audit_release_build.py
+
       - name: Determine version string
         id: version
         run: |