[TrapsterDK]

Part of #8428

Rebased onto main (after #8459 and #8471). #8471's msvc_pdb_output.patch already declares the MSVC PDB at every strip level, so no strip_level change is needed.

Changes

• deploy/release/matrix.bzl: each Windows cell gets <cell>_pdb_archive (dx-windows-<cpu>-pdb.zip, via the Bazel zipper), a .sha256 and an SPDX SBOM. :dx_host_cell_pdb and :dx_host_cell_pdb_sbom alias the host cell. release_cell_symbols names the file; the matrix JSON is unchanged.
• The zip entry is dx_upstream.pdb, not dx.pdb: /pdbaltpath:%_PDB% writes the PDB basename of the upstream rust_binary into dx.exe, so a renamed PDB would not be found next to the exe.
• deploy/release/src/cell.rs: qualify takes optional --symbols and --symbols-rebuild; the determinism check also compares their digests.
• tools/ci/release_cell.sh: builds, copies and rebuilds the symbols zip on Windows cells and passes it to qualify.
• .github/workflows/release.yml: the symbols zip, its .sha256 and SPDX go into the checksum manifest (15 -> 19 lines), files.list and the attestation verification loop.
• cli/adopt/src/launcher.rs: the pin parser skips the symbols zip and its SBOM lines (Windows only).
• Tests: matrix_unit, qualify_compares_the_symbols_rebuild, launcher parser test, release_assets_test strings, windows_host_cell_ships_its_symbols_zip in release_host_cell_test, and the new //cli/cli:dx_opt_pdb_test (dx_msvc_opt_pdb_tests in rust/rules/wrapper_tests.bzl, Windows only, compilation_mode=opt, checks the pdb_file output group is exactly dx_upstream.pdb).

Local (linux): matrix_unit, dx_release_tools_clippy_test, the //rust/rules/... analysis tests and dx_adopt_clippy_test pass. These fail on main too: rustfmt aspect targets (dx_release_tools_fmt_test, bench_report_fmt_test, dx_adopt_fmt_test), bcr_templates_test, bump_version_bin_test, candidate_identity_test, release_assets_test (python in ci.yml; launcher shell pattern), and dx_adopt_test (table_matches_the_repo_module_bazel, deps_match_the_repo_module_bazel). Nested-Bazel and *_consumer_test targets were not run.

Evidence (windows_x86_64, windows_arm64)

• 42221573046 (task=build relocate=true, --config=dx_release, //deploy/release:dx_host_cell //deploy/release:dx_host_cell_pdb): both cells build the exe zip and the pdb zip. The relocated rebuild differs for both, because dx.exe and dx_upstream.pdb themselves still differ after relocation. That is release: reproducible PDB for Windows dx.exe so debug symbols can ship #8410 (same result in its run 42216510920).
• 42221586283 (task=test): dx_opt_pdb_test reported dx_upstream.pdb (fixed in the last commit by expecting that name). host_cell_ships_exactly_its_members fails because the archive lists the CRT DLLs while the cell runtime lists msvc_vcruntime/windows_ucrt. That test is not changed here.

Evidence (stacked on #8568)

• 42232865025 failed at analysis on both cells ('${pwd}' syntax is not supported in a cargo_build_script), caused by release: relative paths in MSVC opt links so the PDB is reproducible (part of #8410) #8568's first commit; release: relative paths in MSVC opt links so the PDB is reproducible (part of #8410) #8568 fixed it in 82d5dff. Rerun as 42235987911 on evidence-8428-on-8568 (ee232e1, now including 82d5dff), same inputs:
• 42235987911 passed (task=build relocate=true, --config=dx_release, //deploy/release:dx_host_cell //deploy/release:dx_host_cell_pdb, windows_x86_64 and windows_arm64) on the throwaway branch evidence-8428-on-8568: this PR merged into release: relative paths in MSVC opt links so the PDB is reproducible (part of #8410) #8568's branch (fix-8410-msvc-paths), no conflicts. Both cells build the exe zip and the pdb zip, so both the exe zip and the pdb zip rebuild identically once release: relative paths in MSVC opt links so the PDB is reproducible (part of #8410) #8568 lands. It proves this PR only together with release: relative paths in MSVC opt links so the PDB is reproducible (part of #8410) #8568 as it is now; if release: relative paths in MSVC opt links so the PDB is reproducible (part of #8410) #8568 changes before merging, rerun it.

Rebased onto main again (f09c42f). Local (linux): matrix_unit, dx_release_tools_clippy_test, dx_adopt_clippy_test and the //rust/tests/fixtures/hello analysis tests (thin_rust_test, wrapper_conformance_tests, wrapper_registry_tests, wrapper_registry_tests_forward) pass. dx_opt_pdb_test is Windows only. Nested-Bazel and *_consumer_test targets were not run.

The host_cell_ships_exactly_its_members failure is tracked in #8571.

Remaining (blocks closing #8428)

• release: relative paths in MSVC opt links so the PDB is reproducible (part of #8410) #8568 (release: reproducible PDB for Windows dx.exe so debug symbols can ship #8410) must land. With it, 42235987911 shows release: ship dx-windows-*-pdb.zip debug symbols with each Windows cell #8428 is done; this PR closes release: ship dx-windows-*-pdb.zip debug symbols with each Windows cell #8428 once both are merged.

🤖 Generated with Claude Code

https://claude.ai/code/session_011u9TXHDZrfmzFQ2WT8QAKK

[TrapsterDK]

Handoff: evidence run 42232865025 (windows_x86_64, windows_arm64, task=build relocate=true, --config=dx_release, //deploy/release:dx_host_cell //deploy/release:dx_host_cell_pdb) runs on evidence-8428-on-8568, which is this PR merged into #8568's fix-8410-msvc-paths (clean merge, launcher.rs and the 19-line manifest unchanged). This PR is rebased onto main at f09c42f and its local checks pass.

When the run finishes:

• Run green and release: relative paths in MSVC opt links so the PDB is reproducible (part of #8410) #8568 merged: rebase this PR onto main, then gh pr ready 8467.
• Run green but release: relative paths in MSVC opt links so the PDB is reproducible (part of #8410) #8568 still open: wait for release: relative paths in MSVC opt links so the PDB is reproducible (part of #8410) #8568 to merge, then do the step above.
• dx.exe or dx_upstream.pdb still differ after relocation: that belongs to release: relative paths in MSVC opt links so the PDB is reproducible (part of #8410) #8568, so comment there, not here.

In every case, delete the throwaway branch afterwards (git push origin --delete evidence-8428-on-8568). Do not remove blocked from #8428 by hand; issue-labels drops it once #8410 closes. If #8568 changes before it merges, rerun the evidence on a fresh combined branch.