v1.3.4

Fixes

• vpnc connect failures now report a real reason in the Debug tab. Success is judged by whether the tunnel actually came up (stock vpnc exits 0 even on fatal errors), and the captured cause — e.g. unknown host, a missing group secret, or cancelled authorization — is persisted so it shows up instead of an empty log.
• Tray checkmark no longer sticks on a VPN name after it goes down.
• Tray checkmark no longer breaks menu-item alignment.

Build / tooling

• Faster compiles — release profile switched to thin LTO + 16 codegen units (parallel across cores) and the lld linker, instead of the serial fat-LTO/codegen-units=1 setup.
• UPX compression in the release pipeline — ./build.sh release and the Arch package now pack the binary (~5.5M → ~1.5M) when upx is installed, and skip cleanly when it isn't.