The sdist is built from the tag by the release path and never attached by hand. The release PR sets version and _tag in the template; the checksum is recorded by a pull request after the tag. Runner requirements, the three container phases and the local dry run are documented.