build: scope the perfview-build feed to the package it provides

[jamescrosswell]

nuget.config maps the perfview-build feed to the * package pattern, so NuGet queries that single-purpose feed for every package in the repo. It proxies upstream and answers 401 — not 404 — for any package version it has not already cached, and NuGet treats a 401 from any mapped source as fatal.

That was harmless for years while the feed served everything, and started failing today when its anonymous upstream fetches began returning 401. It takes out restore on main:

Workload update failed: 401 (Unauthorized - No local versions of package
'microsoft.net.workloads.10.0.400.msi.x64'; please provide authentication to
access versions from upstream that have not yet been saved to your feed.)

This is an external outage, not a code change — main was green as recently as the run for #5503 (2026-08-31T11:14), and the only change before the first red run (2026-09-01T01:21) was #5513, a workflow file. The feed still 401s on those packages as of writing.

Why the feed is still needed

For exactly one package. The perfview submodule references Microsoft.Diagnostics.Tracing.TraceEvent.SupportFiles, and nuget.org only publishes up to 1.0.23:

SupportFiles	nuget.org	perfview-build
1.0.29 (before #5502)	❌	✅
1.0.30 (current)	❌	✅

So this predates the recent submodule bump — the bump moved 1.0.29 → 1.0.30, both of which are perfview-build-only.

The other eleven packages the perfview projects reference (MicroBuild.Core, Microsoft.Bcl.HashCode, Microsoft.Diagnostics.NETCore.Client, Microsoft.Win32.Registry, System.Collections.Immutable, System.IO.Hashing, System.Reflection.Metadata, System.Reflection.TypeExtensions, System.Runtime.CompilerServices.Unsafe, System.Text.Json, Microsoft.SourceLink.GitHub) are all on nuget.org at their exact required versions.

Scoping the mapping to that one package keeps it resolvable while removing the repo's dependency on the feed for everything else, so a future dnceng hiccup can't take out CI again.

Verification

Cold restore of Sentry-CI-Build-macOS.slnf into an empty packages folder (not the warm local cache): 6.1 GB fetched, no errors, and SupportFiles 1.0.30 confirmed resolved from perfview-build.

dotnet-public is healthy and stays mapped to *.

#skip-changelog

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.77%. Comparing base (6e31ca3) to head (f93800f).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5528      +/-   ##
==========================================
+ Coverage   74.66%   74.77%   +0.11%     
==========================================
  Files         515      515              
  Lines       18909    18909              
  Branches     3691     3691              
==========================================
+ Hits        14118    14140      +22     
+ Misses       3906     3881      -25     
- Partials      885      888       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.