The release job checked out CHANGELOG.md after downloading the archives
into dist/, and a checkout cleans the workspace, so the archives were gone
by the time they were uploaded ("uploading *", curl exit 26). The first
v2026.9.30 run failed there and removed its draft; nothing was published.
The checkout now runs first. The job also checks that both archives and
SHA256SUMS are present before it creates a release, and says which is
missing if one is.