fix(void): stage the sdist into the publish set before verifying it

The completeness check requires sdist/<name> in the output directory, but
nothing copied the built sdist there. Copy it from the build work directory
before the signing phase, and pin that order in a test.

packaging/void/build-release.sh

@@ -310,8 +310,9 @@ run_pipeline() {
 		git -C "$ROOT" diff --quiet -- packaging/void/srcpkgs ||
 			fail "the build changed the committed templates"
 	fi
-	mkdir -p "$OUT"
+	mkdir -p "$OUT/sdist"
 	OUT=$(cd "$OUT" && pwd)
+	cp "$WORK/inputs/$SDIST_NAME" "$OUT/sdist/$SDIST_NAME"
 	phase_sign
 	phase_install
 	verify_set

tests/test_void_release_build.py

@@ -557,3 +557,11 @@ def test_smoke_is_the_same_path_with_a_throwaway_key() -> None:
     assert "XBPS_SIGNING_KEY" not in text
     release = _code(BUILD_RELEASE)
     assert "throwaway.pem" in release and "genrsa" in release
+
+
+def test_the_sdist_is_staged_for_publication_before_the_completeness_check() -> None:
+    """The publish set is DIR/sdist plus DIR/xbps; the sdist must be copied there first."""
+    pipeline = _body(_code(BUILD_RELEASE), "run_pipeline")
+    assert 'mkdir -p "$OUT/sdist"' in pipeline
+    assert 'cp "$WORK/inputs/$SDIST_NAME" "$OUT/sdist/$SDIST_NAME"' in pipeline
+    assert pipeline.index('cp "$WORK/inputs/') < pipeline.index("verify_set"), "stage, then verify"