ci(release): retain verified acceptance assets on retry

Author: swkeever

.github/workflows/publish.yml

@@ -100,12 +100,13 @@ jobs:
             mkdir previous
             gh release download "$RELEASE_TAG" --pattern sdk-acceptance.tar.gz --dir previous
             gh attestation verify previous/sdk-acceptance.tar.gz --repo "$GH_REPO" --signer-workflow "$GH_REPO/.github/workflows/publish.yml" --source-ref "refs/tags/$RELEASE_TAG" --source-digest "$GITHUB_SHA" --deny-self-hosted-runners
-            # A retry may regenerate dependency locks, but must test identical SDK bytes.
+            # Keep the authenticated original when a retry rebuilds the same SDK.
             tar -xOf previous/sdk-acceptance.tar.gz ./acceptance.json | jq -S . > previous.json
             tar -xOf release/sdk-acceptance.tar.gz ./acceptance.json | jq -S . > current.json
             cmp previous.json current.json
+            exit 0
           fi
-          gh release upload "$RELEASE_TAG" release/sdk-acceptance.tar.gz --clobber
+          gh release upload "$RELEASE_TAG" release/sdk-acceptance.tar.gz
 
   publish:
     needs: [build, attest]

acceptance/README.md maintainers/acceptance.mdacceptance/README.md renamed to maintainers/acceptance.md

@@ -1,4 +1,7 @@
-# Installed-package acceptance tests
+---
+title: Installed-package acceptance tests
+description: Build and publish the locked consumer project used by Hosting.
+---
 
 Run `bash scripts/build-acceptance.sh <package-file> <output-directory>` after
 building the SDK. The command creates a standalone consumer, installs the exact