A mis-pointed RELEASE_DIR previously published ./dist/release-candidate/<basename> silently because only the basename was honored. Refuse paths that do not resolve to the retained candidate location, and preflight curl >= 7.84 so old binaries fail before surfacing as misleading missing-ETag errors.