fix(void): build the xbps release from the tag, not an attached sdist (#37)

Every release is built from its tag alone by packaging/void/build-release.sh, shared by the tag workflow and local dry runs. Signs in a network-less container with the key mounted read-only and publishes to the tag release and the rolling latest release.

tests/test_void_pywhispercpp_template.py

@@ -20,7 +20,7 @@ REPO_ROOT = Path(__file__).resolve().parents[1]
 VOID_DIR = REPO_ROOT / "packaging" / "void"
 TEMPLATE = VOID_DIR / "srcpkgs" / "python3-pywhispercpp" / "template"
 PINS = VOID_DIR / "tool_checksums.txt"
-BUILD_SH = VOID_DIR / "build.sh"
+BUILD_SH = VOID_DIR / "build-release.sh"
 INSTALL_SH = REPO_ROOT / "install.sh"
 UV_LOCK = REPO_ROOT / "uv.lock"
 
@@ -235,9 +235,8 @@ def test_build_script_uses_podman_and_the_pinned_image() -> None:
     scrubbed = text.lower().replace("never docker", "")
     assert "docker" not in scrubbed, "never Docker"
     assert "tool_checksums.txt" in text, "the image digest comes from the pins file"
-    # The container flow lives in mounted files, not an inline sh -c
-    # string: single quotes inside sh -c silently regroup the command.
-    for name in ("container-main.sh", "container-build.sh"):
-        path = VOID_DIR / name
-        assert path.is_file(), f"missing container script: {path}"
-        assert name in text, f"{BUILD_SH.name} must mount {name}"
+    # The container flow lives in a mounted file, not an inline sh -c string:
+    # single quotes inside sh -c silently regroup the command.
+    name = "container-release.sh"
+    assert (VOID_DIR / name).is_file(), f"missing container script: {name}"
+    assert name in text, f"{BUILD_SH.name} must mount {name}"