feat(release): warn that attempt builds are not upgrade-safe

Hand-installed attempt builds share the plain package version with the
published release, so the updater never replaces them. The diagnostic
page for an attempt ref now says so above the file table (decision 25).

scripts/render-builds-table.py

@@ -53,7 +53,7 @@ from urllib.parse import quote
 # Direct-script invocation starts with scripts/, not the repository root.
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
 
-from scripts.releases import handoff, r2, semver, stable  # noqa: E402
+from scripts.releases import handoff, r2, semver, stable, versioning  # noqa: E402
 
 MARKER = "<!-- HERMES_BUILDS_TABLE -->"
 END_MARKER = "<!-- /HERMES_BUILDS_TABLE -->"
@@ -409,6 +409,13 @@ def render_page(tag: str, assets_by_app: dict, base_url: str,
         f"<p>Release {_link(tag_url)}<code>{html.escape(tag)}</code></a>. Only objects this release "
         "actually staged in the bucket are listed.</p>",
     ]
+    attempt = versioning.parse_attempt_ref(tag)
+    if attempt is not None:
+        version = attempt[0]
+        body.append("<p><strong>"
+                    + html.escape(f"Attempt builds are not upgrade-safe: every attempt of {version} has the same "
+                                  f"package version, so an installed attempt is not replaced by the published {version}.")
+                    + "</strong></p>")
     if incomplete_jobs:
         body.append("<p><strong>Build incomplete.</strong> Jobs not successful: "
                     + html.escape(", ".join(incomplete_jobs))

tests/scripts/test_render_builds_publication.py

@@ -118,6 +118,16 @@ def test_incomplete_tag_keeps_channel_and_links_diagnostics(monkeypatch, r2_serv
     assert r2_server.store['releases/canary/index.html'][0] == b'previous good page'
 
 
+def test_attempt_page_warns_and_canary_page_does_not():
+    base = 'https://cdn.example'
+    sentence = ('Attempt builds are not upgrade-safe: every attempt of 1.2.3 has the same '
+                'package version, so an installed attempt is not replaced by the published 1.2.3.')
+    page = rbt.render_page('rc.1-v1.2.3', {}, base)
+    assert sentence in page
+    for tag in ('v1.2.3', 'v1.2.3+canary.20260818T101010Z', 'abandoned-rc.1-v1.2.3'):
+        assert sentence not in rbt.render_page(tag, {}, base)
+
+
 @pytest.mark.parametrize('version,name', [
     ('1.2.3', 'HermesBundled-1.2.3-win-x64.msix'),
     ('1.2.3+canary.20260818T000000Z', 'HermesBundled-1.2.3+canary.20260818T000000Z-win-x64.msix'),