systemd: enable lto, always run ldconfig