An object file generated with dtrace -G doesn't have a .gnu.lto_.opts section. Afaiu the lto linking is supposed to merge all flags used for all compile steps into the link step, if the flag was used for all .o files. That results in a binary built without any options, if these are not present in the link step.
dtrace is new for me, can you please explain more how it works and what's expected output?
non-LTO objects are not taken into account here so I belive this isn't the reason you are not seeing the CF protection enabled.
dtrace -G calls gcc to generate the .o file, and you can use the CC and CFLAGS environment vars to inject the options you need. Ugly, but you can avoid that by passing the appropriate options.