dev.knotless.release

Kept in the repository owner's account, keyed `<repo key>.<package hash>.<version hash>`, where each hash is the first 26 characters of the lowercase unpadded base32 SHA-256 of `package` or `version`, so a listing from the cursor `<repo key>/` walks one repository's releases, and from `<repo key>.<package hash>/` one package's. Created and never updated: creating it fails if that version was published, so a version's files never change. Deleting it unpublishes the version; to withdraw one that others may have pinned, a dev.knotless.releaseYank leaves it to read. Readers check every file against its `sha256`.