Follow-up to #45. The parallel per-ISA builds worked, but publish-release failed instantly: it runs on the plain base image (no prepare), so it lacks jq, which ci/release.sh needs for the version. It failed before touching any release — the build jobs left a dangling draft (invisible to anvil update; cleaned up manually), and prod kept serving 2026.07.8.

Adds a minimal prepare (curl + jq) to publish-release, and switches its CLI build to debug (faster; it only drives download/upload/publish).

Note: publish is main-only, so this PR run re-validates the parallel builds but not the publish path — the post-merge main run is its real test, which I will watch.