dist: the release job attaches what it collected, not a glob that never matched

Every leg runs the same distributer, and dist.sh prefers `zip` and writes a
`.tar.gz` only when zip is absent - and the Linux job installs zip while macOS
has it - so `artifacts/*.tar.gz` matched nothing on every cut. Under `set -eu`
an unmatched glob is fatal, so the FIRST real release built all six targets
successfully and then failed in the attach step, which is how a published
release ends up with no assets while every build leg is green.

`artifacts/*` is what was collected - the six archives plus the
`SHA256SUMS.txt` the previous step writes - and it covers a `.tar.gz` leg too
if one ever appears. Verified by attaching this release's own artifacts by hand
from the run that built them at the tagged commit.

Author: vecnode

.github/workflows/distribute.yml

@@ -326,5 +326,14 @@ jobs:
           # existing one just gets the assets added (or replaced).
           gh release view "$tag" >/dev/null 2>&1 || \
             gh release create "$tag" --title "$tag" --generate-notes --target "$GITHUB_SHA"
-          gh release upload "$tag" artifacts/*.zip artifacts/*.tar.gz artifacts/SHA256SUMS.txt --clobber
+          # `artifacts/*`, NOT a list of extensions. Every leg runs the same
+          # distributer, and dist.sh PREFERS `zip` and writes a `.tar.gz` only
+          # when zip is absent - and this job installs zip on Linux and macOS
+          # has it - so `artifacts/*.tar.gz` matched nothing on every cut, and an
+          # unmatched glob under `set -eu` killed this step: the first release
+          # built all six targets and then published a release with no assets.
+          # Whatever was collected is what gets attached, checksums included,
+          # and a leg that ever does produce a `.tar.gz` is covered by the same
+          # pattern instead of needing this line edited again.
+          gh release upload "$tag" artifacts/* --clobber
           echo "Attached $(ls artifacts | wc -l) file(s) to $tag."