Read the flat single-artifact layout in release verification

download-artifact@v8 extracts the only pattern-matched artifact directly
into the target path, without the artifact-name directory the resolve
step assumed, so every workflow_run verification died at
"No distributed release identity found" before checking a single
surface. The directory-name attempt check now applies only when the
artifact directory exists; a flat identity is still pinned by the
run-id and attempt-eligibility asserts. The workflow_run path of
5c6588b had never executed: v0.38.0's run failed on later checks and
the surfaces were confirmed by a manual dispatch.

The new test drives the real workflow script against the flat layout
and reproduced the production failure before the fix.

pre-commit: 1) maintain.sh - exit 2 (uv-secure on the documented
lightning/accelerate blocks, unchanged lock; core checks separately:
C2PA sync current, Ruff clean with no rewrites, Pyright src/ 0 errors,
2360 passed 3 skipped); 2) /simplify - single-pass four angles, clean;
3) docs sync - grepped distributed-release over docs/: the one mention
stays accurate; 4) CLAUDE.md - improver grade A earlier this session,
revise: no additions

.github/workflows/verify-release.yml

@@ -59,9 +59,13 @@ jobs:
           import json, os
           from pathlib import Path
           identities = []
-          for path in Path("distribution-identities").glob("*/release-identity.json"):
+          for path in Path("distribution-identities").rglob("release-identity.json"):
               item = json.loads(path.read_text(encoding="utf-8"))
-              assert path.parent.name == 'distributed-release-' + item['run_attempt'], "Artifact attempt mismatch"
+              # download-artifact@v8 extracts the only matched artifact directly
+              # into the path, with no artifact-name directory; several matches
+              # each get one, so the attempt is name-checked only in that layout.
+              if path.parent.name.startswith('distributed-release-'):
+                  assert path.parent.name == 'distributed-release-' + item['run_attempt'], "Artifact attempt mismatch"
               identities.append(item)
           assert identities, "No distributed release identity found"
           assert all(item["run_id"] == os.environ["DISTRIBUTION_RUN_ID"] for item in identities), "Distribution run mismatch"

tests/test_release_workflows.py

@@ -135,6 +135,35 @@ def test_distributed_version_survives_a_newer_pypi_release(tmp_path: Path) -> No
     )
 
 
+@pytest.mark.skipif(os.name != "posix" or shutil.which("bash") is None, reason="Executes an Ubuntu Bash workflow")
+def test_distributed_version_reads_the_flat_single_artifact_layout(tmp_path: Path) -> None:
+    producer = _step("distribute.yml", "resolve", "Record distributed release")
+    consumer = _step("verify-release.yml", "verify", "Resolve target version")
+    env = {
+        **os.environ,
+        "VERSION": "0.37.0",
+        "GITHUB_RUN_ID": "123",
+        "GITHUB_RUN_ATTEMPT": "2",
+        "GITHUB_OUTPUT": str(tmp_path / "output"),
+        "EVENT_NAME": "workflow_run",
+        "INPUT_VERSION": "",
+        "DISTRIBUTION_RUN_ID": "123",
+        "DISTRIBUTION_RUN_ATTEMPT": "2",
+    }
+    subprocess.run(["bash", "-eu", "-c", producer["run"]], cwd=tmp_path, env=env, check=True)
+    # download-artifact@v8 extracts the only pattern-matched artifact directly
+    # into the target path, with no artifact-name directory.
+    artifact = tmp_path / "distribution-identities"
+    artifact.mkdir()
+    (artifact / "release-identity.json").write_bytes((tmp_path / "release-identity.json").read_bytes())
+
+    result = subprocess.run(
+        ["bash", "-eu", "-c", consumer["run"]], cwd=tmp_path, env=env, capture_output=True, text=True
+    )
+    assert result.returncode == 0, result.stderr
+    assert "version=0.37.0" in (tmp_path / "output").read_text()
+
+
 @pytest.mark.skipif(os.name != "posix" or shutil.which("bash") is None, reason="Executes an Ubuntu Bash workflow")
 def test_clawhub_uses_local_install(tmp_path: Path) -> None:
     script = _step("distribute.yml", "clawhub", "Publish the agent skill when its version moved")["run"]