Summary

• Restore separate release symbol archives for macOS, Linux, and Windows binaries.
• Build release binaries with line-tables-only debuginfo instead of full debuginfo.
• Strip Unix distribution binaries after extracting symbols, preserve Windows PDBs, and keep symbol archives available to the release job.
• Strip the packaged Linux bwrap binary before hashing it so the embedded digest matches the distributed bytes.

Root cause

The first symbol-artifact implementation enabled CARGO_PROFILE_RELEASE_DEBUG=full. In the June 2 release runs, macOS ARM primary builds reached the 90-minute timeout while still inside Cargo build. After the symbol changes were reverted, the same primary build completed in about 22 minutes. The archive step itself completed in tens of seconds when reached.

Rust's line-tables-only debuginfo level preserves function names and source locations for symbolication without emitting the heavier variable and type information from full debuginfo.

Validation

• Ran just fmt from codex-rs.
• Ran just test-github-scripts from the repository root: 23 tests passed.
• Ran bash -n and shellcheck on .github/scripts/archive-release-symbols-and-strip-binaries.sh.
• Parsed both modified workflows as YAML and ran git diff --check.
• Built a macOS release smoke binary with line-tables-only, archived its dSYM through the restored script, stripped the production binary, and verified that atos resolves symbol_smoke_function to main.rs:2.
• Ran Linux archive-script control-flow coverage with stubbed objcopy and strip commands.
• Ran Windows PDB archive staging coverage and verified underscore-emitted Rust PDB names are staged under shipped hyphenated binary names.

Follow-up

The release workflow only runs for tags or manual dispatches, so CI cannot dry-run the full release matrix on this PR. The next release run will verify runner time and memory behavior under line-tables-only.