Publish portable PDBs as a NuGet symbol package (.snupkg)

[turbobobbytraykov]

Goal

Publish portable PDBs in a .snupkg alongside each NuGet package so consumers can use Source Link and the NuGet.org symbol server for source-level debugging and production diagnostics.

The symbols should remain out of the main .nupkg; a separate symbol package preserves a smaller primary package while still making source mappings available to debuggers.

Benefits

• Enables step-through debugging into Infragistics.QueryBuilder.Executor from consuming applications.
• Improves stack-trace investigation and production diagnostics through accurate source and line mappings.
• Integrates with the NuGet.org symbol server and Source Link instead of requiring consumers to locate symbols manually.
• Keeps the primary .nupkg smaller than an approach that embeds portable PDBs in the main package.

Costs and risks

• Introduces another release artifact whose exact bytes must remain consistent across packing, signing policy, digest handoffs, publishing, attestations, SBOM evidence, retention, and GitHub release attachments.
• Adds workflow complexity around symbol-package validation, publication ordering, reruns, and partial failures where the main package succeeds but symbol indexing or publication fails.
• Increases release evidence size, storage, and maintenance burden.
• Creates additional validation requirements for portable PDB format, Source Link mappings, source availability, and NuGet.org symbol indexing.
• May expose repository paths and source mapping metadata; this should be reviewed even though the source repository is public.

Proposed acceptance criteria

• The project emits portable PDBs in Infragistics.QueryBuilder.Executor.<version>.snupkg and does not add them to the main .nupkg.
• Source Link mappings are validated against the repository and release commit before publication.
• The release workflow defines and enforces whether the .snupkg requires author signing, attestation, checksums, and SBOM coverage.
• The symbol package digest is preserved and checked across every job handoff that consumes or publishes it.
• NuGet.org receives both artifacts, and the workflow detects and reports symbol publication or indexing failures without associating mismatched evidence with an existing package version.
• Release evidence and documentation identify the exact .snupkg associated with the published .nupkg.