dev-c6d4443

fix(release): only a version tag is "latest"

`make_latest: "true"` sat on every `action-gh-release` call, so the newest
build of any kind won the label. MEASURED minutes after v1.1.0 was published:
`/releases/latest` answered `main-7c3a82f`, a rolling branch snapshot from
fourteen minutes later, which means the URLs this README documents --
`releases/latest/download/bore-x86_64-unknown-linux-musl` and friends -- handed
out a branch build instead of the release that had just been gated for it.

`ci/version.bash` already publishes `is_tag`; it is now what decides. A branch
build is additionally marked `prerelease`, which is what README has always
called it and what keeps it out of the contest even if the flag is bypassed.

The two fields are repeated on all five invocations, not only on the job that
creates the release: `action-gh-release` DEFAULTS `make_latest` to true, so an
upload job silently re-claims the label the create job just declined. Setting
it in one place would have looked correct and changed nothing.

v1.1.0 was re-pointed by hand. Verified by CONTENT, not by the label:
`latest/download/bore-x86_64-unknown-linux-musl` and
`download/v1.1.0/bore-x86_64-unknown-linux-musl` hash to the same
b8f8ed26...94910, and the branch build that had taken the label hashes to
0019dfc4...b49b5.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BqfehFhjLR3Yj1sgaf5KCi