fix(ci): build the release binaries before copying packaging files in

Every published artifact was stamped `vcs.modified=true` with module version
`+dirty` (verified on v1.6.1, v1.6.2 and v1.7.0): the packaging step copies
`.github/sower.toml` and the service files into the repository root, and the
toolchain records the worktree state at build time. sowerd.service is neither
tracked nor ignored, so the tree was dirty before the compiler ran. Kr's edge
deployment rule ("confirm vcs.modified=false") was therefore unsatisfiable
from a release artifact, and the binary could not be held to any commit.

Move the copies and the tarball into a Package step that runs after the build.
Verified locally: building this commit on a clean tree reports `v1.7.0` with
vcs.modified=false, while copying one service file in first reproduces
`v1.7.0+dirty` — the same experiment the next tag re-runs end to end.

.github/workflows/release.yml

@@ -98,13 +98,6 @@ jobs:
           name: web-dist
           path: web/dist
 
-      - name: Prepare packaging files
-        run: |
-          cp .github/sower.toml .
-          # matrix.service lists space-separated file names ("sower.service
-          # sowerd.service"); prefix each with .github/ individually.
-          for s in ${{ matrix.service }}; do cp ".github/$s" .; done
-
       - name: Build binaries
         env:
           GOOS: ${{ matrix.goos }}
@@ -115,6 +108,17 @@ jobs:
           ldflags="-X main.version=$(git describe --tags --always) -X main.date=$(date +%Y-%m-%d)"
           go build -ldflags "$ldflags" -o sower${{ matrix.ext }} ./cmd/sower
           go build -ldflags "$ldflags" -o sowerd${{ matrix.ext }} ./cmd/sowerd
+
+      # The packaging files are copied in only after the build: they land in the
+      # repository root, and the toolchain stamps the worktree state into each
+      # binary, so copying them first published every artifact as a build no
+      # commit can be held to (`vcs.modified=true`, module version `+dirty`).
+      - name: Package
+        run: |
+          cp .github/sower.toml .
+          # matrix.service lists space-separated file names ("sower.service
+          # sowerd.service"); prefix each with .github/ individually.
+          for s in ${{ matrix.service }}; do cp ".github/$s" .; done
           tar czf sower-${{ matrix.name }}.tar.gz \
             sower${{ matrix.ext }} sowerd${{ matrix.ext }} sower.toml \
             ${{ matrix.service }}