No release is complete without at least one procedural mistake. In this case, I forgot to tag the release, and rolled the tarball from the branch instead of the (nonexistent) tag. Oh well, better luck next time...
Thanks to ssm@ for pointing it out.