An XPI package that is debuggable would contain exactly the same information as your source code (it’s just a ZIP archive of your code, after all).
claim it to be his job
Being the first to publish it on amo puts the same claim of creation to it as being the first to publish it anywhere else.
Besides, publishing your source code (without an open souce license) doesn’t mean your code is open source (see here). If someone “takes” your code (for anything else than strictly personal use (which you wouldn’t know of anyway)) it’s still theft (according to most/all legal systems in the world).