The packages are uploaded with archive: false, and non-zipped artifacts can
only be fetched by v8 of download-artifact - v7 fetched the first one, then
failed the run with "Unable to download and extract artifact".
Workflow artifacts can only be downloaded by signed-in users with access to
the repository, so they are useless for handing a build to anyone else. After
the matrix publishes, a release job recreates a rolling pre-release from the
same packages; its assets are downloadable without an account:
releases/download/latest/<file> from main
releases/download/staging/<file> from staging
Each branch owns its tag, so a staging build never overwrites the main one.
The release is deleted and created again rather than edited, so the tag
follows its branch and assets from an older build do not linger. Write access
is granted to that job only, the workflow default stays read.
