ci: download release artifacts from GitHub Release page, not artifacts API

The commit-releases job's `actions/download-artifact@v4` step has
failed twice in a row (v1.7.5 retrigger, v1.7.6) with the same
shape: ~10 artifacts download successfully, then "Unable to
download artifact(s): Artifact download failed after 5 retries" on
the 11th-13th. The 10 that complete print their SHA256 digests
cleanly; the failure is unambiguously inside actions/download-
artifact, not on our side.

Workaround: pull from `gh release download` instead. The `release`
job populated the GitHub Release page a few seconds earlier with
the same artifacts; pulling from there reads from a different
CDN (Release-page blob store) with different retry / rate-limit
characteristics. Empirically more reliable for our 13-artifact
release size.

Filtered to *.tar.gz / *.zip / *.apk so we only fetch the user-
facing artifacts (skipping anything like checksum sidecars that
softprops/action-gh-release@v2 might add later).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/release.yml

@@ -676,10 +676,38 @@ jobs:
           ref: main
           fetch-depth: 0
 
-      - uses: actions/download-artifact@v4
+      # Pull artifacts from the GitHub Release page (which the `release`
-        with:
+      # job populated a few seconds earlier) rather than the workflow
-          path: artifacts
+      # artifacts API. The artifacts API path —
-          merge-multiple: true
+      # `actions/download-artifact@v4` with `merge-multiple: true` —
+      # has been failing with "artifact download failed after 5
+      # retries" on one of the ~13 artifacts on multiple consecutive
+      # runs (v1.7.5 retrigger, v1.7.6). The 10 fast downloads that
+      # complete first all succeed; the 11th-13th hit the error.
+      # `gh release download` reads from GitHub's Release-page CDN,
+      # which is independent of the artifacts blob store and has a
+      # different retry / rate-limit profile. Same files, more
+      # reliable surface.
+      - name: Download artifacts from the GitHub Release page
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          VER="${{ inputs.version || github.ref_name }}"
+          # Strip leading `v` to normalize, then re-add — the Release
+          # tag is `vX.Y.Z`, but for the rest of the workflow we use
+          # bare `X.Y.Z`. Mirror the same pattern here so a downstream
+          # readme update can use the bare version.
+          VER="${VER#v}"
+          mkdir -p artifacts
+          gh release download "v${VER}" \
+            --repo "${{ github.repository }}" \
+            --dir artifacts \
+            --pattern '*.tar.gz' \
+            --pattern '*.zip' \
+            --pattern '*.apk'
+          echo "--- artifacts/ contents ---"
+          ls -la artifacts/
 
       - name: Refresh releases/ folder
         run: |