[ABLD-464] Strip debug symbols at packaging time (Plan B)

**what this does**
Adds a packaging-time filter, `dd_pkg_files_stripped` (in
`bazel/rules/dd_packaging/dd_pkg_strip_transform.bzl`), that replaces plain
`pkg_files` calls for shipped binaries. It strips object files as they're
collected into a package and splits the removed debug info into a parallel
`name + "_debug"` sibling target, without requiring any cooperation from the
binary's own build rule -- it works directly against prebuilt-file-backed
targets like `@agent_binary//:agent`, which is this design's main advantage
over the alternative provider/rule-based approach considered in the same
design doc (Plan A, implemented separately).

A single `_dd_strip_split` action runs strip/objcopy/dsymutil once per file
and declares both the "stripped" and "debug" outputs at once; the public
`dd_pkg_strip_transform` rule only projects one half of that shared result,
so building both the normal package and its debug sibling never doubles the
work. File-type detection (ELF/Mach-O/PE) happens at action-execution time in
a new Python driver (`dd_strip_driver.py`), since Starlark can't inspect file
contents during analysis; the Starlark side only applies a cheap
extension/mode-bit heuristic to skip spawning actions for obviously
non-binary files.

Tool paths come from a new `//bazel/toolchains/dd_strip` toolchain: Linux and
Windows source `strip`/`objcopy` off the existing `cc_toolchain`; macOS
hardcodes `/usr/bin/strip` and `/usr/bin/dsymutil` (modeled after
`//bazel/rules/rewrite_rpath`'s hardcoded-path pattern rather than
`//bazel/toolchains/codesign`'s auto-detecting repository_rule, since that
pattern generates a `config_setting` per tool and new config_settings need
separate design review).

Platform semantics match `omnibus-ruby/lib/omnibus/stripper.rb`: Linux does
the 3-step objcopy --only-keep-debug / strip / objcopy --add-gnu-debuglink;
macOS runs `strip -x` plus `dsymutil` into a `.dSYM` bundle; Windows ships a
`strip`'d binary alongside the unstripped original (mingw's toolchain has no
`objcopy`, so there's no split-DWARF story there, matching the existing
`windows_symbol_stripping_file` behavior).

Wired into `packages/agent/product/BUILD.bazel` (the four `dda_built_*_binary`
targets, plus a new `all_files_debug` pkg_filegroup) and
`packages/installer/windows/BUILD.bazel` (`installer_binary` plus a new
`installer_components_debug`). Removed the one-shot
`-Cstrip=symbols` rustc flag from `bazel/configs/system_probe_lite.bazelrc`,
which used to destroy debug info before packaging ever saw it. Updated
`packages/AGENTS.md` and `packages/installer/MIGRATION_PLAN.md` to reflect
that symbol stripping is now migrated.

**testing**
Built and inspected output on macOS (arm64) at each stage:
- A throwaway target wrapping `//cmd/loader:loader` confirmed both the
  "stripped" and "debug_only" modes produce sane output: `strip -x` removed
  local symbols, `dsymutil` produced a `.dSYM` bundle with a DWARF resource,
  and building both mode targets together registered the `DdStripSplit`
  action exactly once (verified in the verbose build log).
- `bazel build //packages/agent/product:all_files //packages/agent/product:all_files_debug`
  and `//packages/installer/windows:whole_distro_tar //packages/installer/windows:installer_components_debug`
  succeed against the real prebuilt targets (`@agent_binary`,
  `@trace_agent_binary`, `@process_agent_binary`,
  `@privateactionrunner_binary`, `@installer_binary`).
- Along the way, fixed two real bugs surfaced by this: `Args.add()` can't
  take a directory (needed `.path` for the `.dSYM` output), and the
  passthrough path crashed when the declared debug output was a directory
  but the driver couldn't recognize the input's format (hit when packaging a
  Linux ELF prebuilt from a macOS host, since the macOS toolchain has no
  objcopy -- this is a local-only condition, not a bug in the Linux path
  itself).
- `bazel test //bazel/rules/dd_packaging:_dd_packaging_tests` (the existing
  suite) still passes -- no regression in the unrelated packaging rules this
  shares a package with.
- Could NOT verify on this machine: the actual Linux ELF split (no Linux
  sandbox/CI available locally -- the `@trace_agent_binary` prebuilt is a
  real Linux ELF, but macOS's `dd_strip` toolchain has no `objcopy`, so it
  fell through to passthrough rather than exercising `_strip_elf`), and
  whether the produced `.dSYM`/`.debug` artifacts are actually useful to a
  debugger (no symbolication round-trip was attempted).
- No unit tests were added for `dd_pkg_strip_transform`/`_dd_strip_split`
  themselves (analysistest-style, like `dd_packaging_test.bzl`) -- only
  manual `bazel build` + filesystem inspection.

**next steps**
- The Linux objcopy path needs validation in CI or a Linux sandbox before
  this can be trusted end-to-end.
- The macOS `dSYM`-splitting approach hasn't been reviewed by the build
  team; `strip -x` semantics (keeps global symbols) match omnibus but
  deserve a second look.
- Whatever builds `bin/agent/agent` and friends outside Bazel (dda/omnibus)
  must also stop pre-stripping, or there will be no debug info left for this
  filter to split off -- that's a separate, out-of-scope dependency for this
  PR (the Rust/system-probe-lite case is fixed here; the Go/dda case is not).
- Plan A (implemented separately, in parallel) builds its own independent
  copy of the same toolchain shape under `//bazel/toolchains/dd_strip` by
  design -- deduplicating the two toolchains is a deliberate follow-up, not
  done here.

Author: aiuto

MODULE.bazel

@@ -205,6 +205,12 @@ register_toolchains(
     "//bazel/toolchains/rpath_rewriter:patchelf_toolchain",
 )
 
+register_toolchains(
+    "//bazel/toolchains/dd_strip:dd_strip_linux_toolchain",
+    "//bazel/toolchains/dd_strip:dd_strip_macos_toolchain",
+    "//bazel/toolchains/dd_strip:dd_strip_windows_toolchain",
+)
+
 find_rpmbuild = use_extension("@rules_pkg//toolchains/rpm:rpmbuild_configure.bzl", "find_system_rpmbuild_bzlmod", dev_dependency = True)
 use_repo(find_rpmbuild, "rules_pkg_rpmbuild")
 

bazel/configs/system_probe_lite.bazelrc

@@ -3,5 +3,10 @@
 build:system-probe-lite-release --@rules_rust//rust/settings:lto=fat # Enable fat LTO
 build:system-probe-lite-release --@rules_rust//rust/settings:extra_rustc_flag=-Copt-level=z # Optimize for size
 build:system-probe-lite-release --@rules_rust//rust/settings:extra_rustc_flag=-Ccodegen-units=1 # Single codegen unit for maximum optimization
-build:system-probe-lite-release --@rules_rust//rust/settings:extra_rustc_flag=-Cstrip=symbols # Strip debug symbols
 build:system-probe-lite-release --@rules_rust//rust/settings:extra_rustc_flag=-Cpanic=abort # Remove stack unwinding
+# NOTE (ABLD-464): symbol stripping used to happen here as a one-shot rustc
+# flag (-Cstrip=symbols), which destroyed debug info before packaging ever
+# saw it. Stripping is now a packaging-time concern -- see
+# //bazel/rules/dd_packaging:dd_pkg_strip_transform.bzl -- so debug info must
+# survive the compile step for the debug/stripped split to have anything to
+# split. Do not re-add a compile-time strip flag here.

bazel/rules/dd_packaging/BUILD.bazel

@@ -1,3 +1,10 @@
+load("@rules_python//python:py_binary.bzl", "py_binary")
 load(":dd_packaging_test.bzl", "dd_packaging_test_suite")
 
 dd_packaging_test_suite(name = "_dd_packaging_tests")
+
+py_binary(
+    name = "dd_strip_driver",
+    srcs = ["dd_strip_driver.py"],
+    visibility = ["//visibility:public"],
+)

bazel/rules/dd_packaging/dd_pkg_strip_transform.bzl

@@ -0,0 +1,304 @@
+"""dd_pkg_strip_transform — packaging-time strip/debug-split filter (ABLD-464 Plan B).
+
+Consumes a PackageFilesInfo (the same `dest_src_map: {dest_path: File}`
+structure dd_cc_packaged.bzl and dd_collect_dependencies.bzl already operate
+on) and emits a new PackageFilesInfo pointing at transformed files:
+
+  - mode = "stripped" (default): object files have symbol tables/debug info
+    removed; everything else (configs, licenses, scripts, directories, ...)
+    passes through byte-for-byte unchanged.
+  - mode = "debug_only": only the split-off debug artifacts remain --
+    non-object-file entries are dropped from the dest_src_map entirely, since
+    e.g. a config file has no debug info and should not appear in the
+    debug-only sibling package.
+
+Because this operates on the already-flattened, merged dest_src_map (after
+pkg_files has resolved srcs to Files), it needs no cooperation from the
+binary's own build rule -- it works against `prebuilt_file`-backed filegroups
+like `@agent_binary//:agent` today, which is this design's main advantage
+over the provider/rule-based alternative (see the ABLD-464 design doc).
+
+IMPLEMENTATION NOTE on avoiding double work: the "stripped" and "debug_only"
+modes must not each independently run strip/objcopy/dsymutil on the same
+file -- that would double the work for every packaging build that produces
+both a package and its debug sibling. To guarantee this, the actual
+strip/split actions live in the private `_dd_strip_split` rule (one action
+per file, declaring BOTH outputs at once); `dd_pkg_strip_transform` itself
+creates no actions of its own -- it only *selects* which half of
+`_dd_strip_split`'s already-declared outputs to expose. As long as both the
+"stripped" and "debug_only" `dd_pkg_strip_transform` instances point at the
+same `_dd_strip_split` target (which `dd_pkg_files_stripped` guarantees by
+construction), Bazel analyzes that shared target once, so the action runs at
+most once per file no matter how many of its consumers are built.
+
+File-type detection (ELF vs Mach-O vs PE vs "not an object file at all") is
+necessarily a runtime concern -- Starlark cannot inspect file contents during
+the analysis phase -- so it happens in dd_strip_driver.py, not here. This
+file's `_looks_like_object_file` is only a cheap, best-effort Starlark-side
+heuristic (extension + the pkg_files group's executable-bit attribute) used
+to skip spawning an action at all for files that are obviously not object
+code; the driver script is the authoritative fallback for anything else.
+"""
+
+load("@rules_pkg//pkg:mappings.bzl", "pkg_files")
+load("@rules_pkg//pkg:providers.bzl", "PackageFilesInfo")
+
+_DD_STRIP_TOOLCHAIN = "//bazel/toolchains/dd_strip:toolchain_type"
+
+# Extensions that are unambiguously not machine code. Skipping these avoids
+# spawning a strip action (and, in debug_only mode, a spurious dest_src_map
+# entry) for the configs/licenses/docs/scripts that make up most of a
+# package tree. This is only a fast-path optimization -- see the module
+# docstring; dd_strip_driver.py's magic-byte sniffing is authoritative.
+_NEVER_BINARY_EXTENSIONS = (
+    ".yaml",
+    ".yml",
+    ".json",
+    ".txt",
+    ".md",
+    ".cfg",
+    ".conf",
+    ".ini",
+    ".py",
+    ".sh",
+    ".rb",
+    ".pem",
+    ".crt",
+    ".key",
+    ".png",
+    ".svg",
+    ".html",
+    ".example",
+    ".license",
+)
+
+_ALWAYS_BINARY_SUFFIXES = (".so", ".dylib", ".dll", ".exe")
+
+def _looks_like_object_file(dest, executable):
+    """Best-effort guess at whether `dest` is worth spawning a strip action for.
+
+    Errs toward "maybe" -- a false positive here just costs a wasted action
+    that the driver script turns into a no-op passthrough. A false negative
+    would silently skip stripping a real binary, so extensionless files
+    (typical for Go/Rust/C binaries shipped as e.g. "bin/agent/agent") are
+    treated as plausible whenever the enclosing pkg_files group is marked
+    executable.
+    """
+    lower = dest.lower()
+    if lower.endswith(_ALWAYS_BINARY_SUFFIXES) or ".so." in lower:
+        return True
+    for ext in _NEVER_BINARY_EXTENSIONS:
+        if lower.endswith(ext):
+            return False
+    basename = lower.rsplit("/", 1)[-1]
+    if "." not in basename:
+        return True
+    return executable
+
+_DdStripSplitInfo = provider(
+    doc = "Internal: the per-mode dest_src_maps produced by one shared strip/split pass.",
+    fields = {
+        "stripped_dest_src_map": "dict: dest path -> stripped File, for every entry in the source PackageFilesInfo.",
+        "debug_dest_src_map": "dict: dest path -> debug File/directory, for entries that were actually strippable object files.",
+        "attributes": "the source PackageFilesInfo.attributes, forwarded as-is.",
+        "debug_attributes": "attributes to apply to the debug_only dest_src_map (mode forced non-executable).",
+    },
+)
+
+def _debug_attributes(attributes):
+    # Debug artifacts (.debug files / .dSYM bundles / unstripped originals)
+    # are inspected by debuggers, not executed -- ship them non-executable
+    # regardless of what mode the shipped binary itself uses.
+    result = dict(attributes)
+    result["mode"] = "0644"
+    return result
+
+def _dd_strip_split_impl(ctx):
+    toolchain = ctx.toolchains[_DD_STRIP_TOOLCHAIN]
+    strip_info = toolchain.dd_strip_info if toolchain else None
+    src_info = ctx.attr.src[PackageFilesInfo]
+    executable = "x" in src_info.attributes.get("mode", "")
+
+    # macOS debug output is a dsymutil .dSYM bundle (a directory); Linux's
+    # objcopy --only-keep-debug and Windows' "copy of the unstripped
+    # original" are both single files.
+    debug_is_dir = bool(strip_info and strip_info.dsymutil_path)
+    debug_suffix = ".dSYM" if debug_is_dir else (".debug" if strip_info and strip_info.objcopy_path else "")
+
+    stripped_dest_src_map = {}
+    debug_dest_src_map = {}
+    all_outputs = []
+
+    for dest, file in src_info.dest_src_map.items():
+        # Directories (TreeArtifacts) aren't split element-by-element by this
+        # rule; ship them unstripped and exclude them from the debug sibling.
+        # This is a known limitation of the packaging-time-filter approach --
+        # see the ABLD-464 design doc.
+        if file.is_directory or not _looks_like_object_file(dest, executable) or strip_info == None:
+            stripped_dest_src_map[dest] = file
+            continue
+
+        stripped_out = ctx.actions.declare_file("dd_strip/stripped/" + dest)
+        if debug_is_dir:
+            debug_out = ctx.actions.declare_directory("dd_strip/debug/" + dest + debug_suffix)
+        else:
+            debug_out = ctx.actions.declare_file("dd_strip/debug/" + dest + debug_suffix)
+
+        args = ctx.actions.args()
+        args.add("--input", file)
+        args.add("--stripped-out", stripped_out)
+        args.add("--debug-out", debug_out.path)
+        if debug_is_dir:
+            args.add("--debug-out-is-dir")
+        if strip_info.strip_path:
+            args.add("--strip", strip_info.strip_path)
+        if strip_info.objcopy_path:
+            args.add("--objcopy", strip_info.objcopy_path)
+        if strip_info.dsymutil_path:
+            args.add("--dsymutil", strip_info.dsymutil_path)
+
+        ctx.actions.run(
+            executable = ctx.executable._driver,
+            arguments = [args],
+            inputs = depset([file], transitive = [strip_info.tool_files]),
+            outputs = [stripped_out, debug_out],
+            mnemonic = "DdStripSplit",
+            progress_message = "Splitting debug symbols from %s" % dest,
+            toolchain = _DD_STRIP_TOOLCHAIN,
+        )
+
+        stripped_dest_src_map[dest] = stripped_out
+        debug_dest_src_map[dest] = debug_out
+        all_outputs.extend([stripped_out, debug_out])
+
+    return [
+        _DdStripSplitInfo(
+            stripped_dest_src_map = stripped_dest_src_map,
+            debug_dest_src_map = debug_dest_src_map,
+            attributes = src_info.attributes,
+            debug_attributes = _debug_attributes(src_info.attributes),
+        ),
+        DefaultInfo(files = depset(all_outputs)),
+    ]
+
+_dd_strip_split = rule(
+    implementation = _dd_strip_split_impl,
+    doc = """Internal: runs the actual strip/split action once per (strippable) file.
+
+    Not meant to be used directly -- use dd_pkg_files_stripped. Kept separate
+    from dd_pkg_strip_transform so that "stripped" and "debug_only" mode
+    instances can share a single set of actions; see the module docstring.
+    """,
+    attrs = {
+        "src": attr.label(
+            mandatory = True,
+            providers = [PackageFilesInfo],
+        ),
+        "_driver": attr.label(
+            default = Label("//bazel/rules/dd_packaging:dd_strip_driver"),
+            executable = True,
+            cfg = "exec",
+        ),
+    },
+    toolchains = [config_common.toolchain_type(_DD_STRIP_TOOLCHAIN, mandatory = False)],
+)
+
+def _dd_pkg_strip_transform_impl(ctx):
+    split_info = ctx.attr.split[_DdStripSplitInfo]
+    if ctx.attr.mode == "debug_only":
+        dest_src_map = split_info.debug_dest_src_map
+        attributes = split_info.debug_attributes
+    else:
+        dest_src_map = dict(split_info.stripped_dest_src_map)
+        attributes = split_info.attributes
+
+    return [
+        PackageFilesInfo(
+            dest_src_map = dest_src_map,
+            attributes = attributes,
+        ),
+        # Without an explicit DefaultInfo, `bazel build`/`cquery --output=files`
+        # against this target directly would request the (empty) implicit
+        # default output group and never actually force the underlying
+        # _dd_strip_split action to run. Packaging rules only look at
+        # PackageFilesInfo, but this makes `bazel build` on the label alone
+        # (as in local iteration, or a debug-package pkg_filegroup) do
+        # something observable.
+        DefaultInfo(files = depset(dest_src_map.values())),
+    ]
+
+dd_pkg_strip_transform = rule(
+    implementation = _dd_pkg_strip_transform_impl,
+    doc = """Projects one mode's worth of a shared _dd_strip_split's outputs into a PackageFilesInfo.
+
+    Not meant to be used directly -- use dd_pkg_files_stripped.
+    """,
+    attrs = {
+        "split": attr.label(
+            mandatory = True,
+            providers = [_DdStripSplitInfo],
+        ),
+        "mode": attr.string(
+            mandatory = True,
+            values = ["stripped", "debug_only"],
+        ),
+    },
+    provides = [PackageFilesInfo],
+)
+
+def dd_pkg_files_stripped(name, srcs, prefix = "", mode = "stripped", **kwargs):
+    """A pkg_files-alike whose binaries are stripped at packaging time.
+
+    Behaves like `pkg_files(name, srcs, prefix, **kwargs)`, except object
+    files (recognized as ELF/Mach-O/PE by dd_strip_driver.py) have their
+    debug info split off instead of shipping unmodified. `name` carries the
+    requested `mode`'s worth of the result (default "stripped", i.e. the
+    normal packaging behavior with debug info removed); a `name + "_debug"`
+    sibling target is always created as well (mode="debug_only"), containing
+    only the split-off debug artifacts -- reference that label from a debug
+    package's pkg_filegroup. Both labels are backed by the same underlying
+    strip/split actions, so building both never runs strip/objcopy/dsymutil
+    twice on the same file (see dd_pkg_strip_transform.bzl for why that
+    matters).
+
+    Args:
+        name: name of the "stripped"-mode target (or whatever `mode` requests).
+        srcs: same as pkg_files' srcs.
+        prefix: same as pkg_files' prefix.
+        mode: "stripped" (default) or "debug_only". Only pass "debug_only"
+            directly if you don't need the normal stripped-package variant
+            at all -- in that case no "_debug" sibling is created, since
+            `name` already is the debug-only variant.
+        **kwargs: forwarded to the underlying pkg_files call (e.g. attributes).
+    """
+    files_name = name + "_pkg_files"
+    split_name = name + "_split"
+
+    pkg_files(
+        name = files_name,
+        srcs = srcs,
+        prefix = prefix,
+        tags = ["manual"],
+        visibility = ["//visibility:private"],
+        **kwargs
+    )
+
+    _dd_strip_split(
+        name = split_name,
+        src = ":" + files_name,
+        tags = ["manual"],
+        visibility = ["//visibility:private"],
+    )
+
+    dd_pkg_strip_transform(
+        name = name,
+        split = ":" + split_name,
+        mode = mode,
+    )
+
+    if mode != "debug_only":
+        dd_pkg_strip_transform(
+            name = name + "_debug",
+            split = ":" + split_name,
+            mode = "debug_only",
+        )