feat: enhance release workflow with debuginfo support

- Added support for generating and packaging debug symbols for binaries.
- Updated the build process to create separate .debug files and include them in a tarball.
- Modified the release artifacts to include the new debug symbol tarball and its checksum.

Author: 78

.github/workflows/release.yml

@@ -101,12 +101,27 @@ jobs:
               ghcr.io/78/tenbox-build:bullseye-${{ matrix.arch }} \
               bash -lc '
                   set -euo pipefail
+                  # Keep -O3 for runtime, but add -g so we can split debuginfo
+                  # into sibling .debug files before stripping. The .deb still
+                  # ships stripped binaries; the .debug files are uploaded as
+                  # a separate artifact so any future coredump can be
+                  # symbolised offline by matching BuildID.
                   cmake -B build -G Ninja \
                       -DCMAKE_BUILD_TYPE=Release \
+                      -DCMAKE_C_FLAGS_RELEASE="-O3 -g -DNDEBUG" \
+                      -DCMAKE_CXX_FLAGS_RELEASE="-O3 -g -DNDEBUG" \
                       -DTENBOX_STATIC_FFMPEG=ON \
                       -DTENBOX_STATIC_RUNTIME=ON
                   cmake --build build --parallel
-                  strip build/tenbox build/tenboxd build/tenbox-vm-runtime
+                  cd build
+                  for bin in tenbox tenboxd tenbox-vm-runtime; do
+                      objcopy --only-keep-debug "$bin" "$bin.debug"
+                      strip --strip-debug --strip-unneeded "$bin"
+                      # debuglink stores only basename, so cwd=build keeps the
+                      # embedded reference clean (tenboxd -> tenboxd.debug).
+                      objcopy --add-gnu-debuglink="$bin.debug" "$bin"
+                      chmod 0644 "$bin.debug"
+                  done
               '
 
       - name: Build .deb
@@ -115,6 +130,15 @@ jobs:
               "${{ matrix.arch }}" \
               "${{ steps.ver.outputs.version }}"
 
+      - name: Stage debuginfo tarball
+        run: |
+          set -euo pipefail
+          mkdir -p dist
+          out="dist/tenbox_${{ steps.ver.outputs.version }}_${{ matrix.arch }}-dbgsym.tar.zst"
+          tar --zstd -cf "$out" -C build \
+              tenbox.debug tenboxd.debug tenbox-vm-runtime.debug
+          ( cd dist && sha256sum "$(basename "$out")" > "$(basename "$out").sha256" )
+
       # Sanity-check the deb against Bullseye's dpkg (1.20). The runner
       # is Ubuntu 22.04 with dpkg 1.21+, which can read both xz and zstd
       # archives, so a deb that secretly slipped to zstd would still
@@ -139,6 +163,8 @@ jobs:
           path: |
             dist/tenbox_${{ steps.ver.outputs.version }}_${{ matrix.arch }}.deb
             dist/tenbox_${{ steps.ver.outputs.version }}_${{ matrix.arch }}.deb.sha256
+            dist/tenbox_${{ steps.ver.outputs.version }}_${{ matrix.arch }}-dbgsym.tar.zst
+            dist/tenbox_${{ steps.ver.outputs.version }}_${{ matrix.arch }}-dbgsym.tar.zst.sha256
 
   publish-release:
     name: Publish GitHub Release
@@ -186,6 +212,10 @@ jobs:
           files: |
             dist/tenbox_${{ steps.ver.outputs.version }}_amd64.deb
             dist/tenbox_${{ steps.ver.outputs.version }}_amd64.deb.sha256
+            dist/tenbox_${{ steps.ver.outputs.version }}_amd64-dbgsym.tar.zst
+            dist/tenbox_${{ steps.ver.outputs.version }}_amd64-dbgsym.tar.zst.sha256
             dist/tenbox_${{ steps.ver.outputs.version }}_arm64.deb
             dist/tenbox_${{ steps.ver.outputs.version }}_arm64.deb.sha256
+            dist/tenbox_${{ steps.ver.outputs.version }}_arm64-dbgsym.tar.zst
+            dist/tenbox_${{ steps.ver.outputs.version }}_arm64-dbgsym.tar.zst.sha256
             dist/install-linux.sh