docs: record artifact download verification

docs/operations/CURRENT_STATE.md

@@ -42,9 +42,11 @@ conflicts with this dated recheck.
   The run API identifies run ID 567 and reports `run_attempt: 0`, Gitea's
   legacy sentinel. The release workflow therefore uses the unique run ID and
   does not depend on the unavailable attempt value. The run's artifact link was
-  visible in Gitea UI, while the API artifact listing available to this
-  principal returned no entries, so artifact retrieval is not independently
-  verified here. No live release or VPS change was made.
+  downloaded from Gitea UI as `artifact-smoke-567-`: the ZIP was 191 bytes,
+  SHA-256 `ae0a2262147f222aacb4fdd1d12459f7160c67b1d0ee5d7ae2db1de8958f120f`,
+  and contained the expected 51-byte `marker.txt`. The API artifact listing
+  available to this principal returned no entries, but the downloaded file
+  verifies artifact availability. No live release or VPS change was made.
 - Owner-only outstanding evidence: sanitized container/volume and protected
   file metadata; current backup and separate-target restore verification;
   live corpus/index counts and RU/KY canaries; Cloudflare TLS mode; registry