protoc version integrity check always fails with tarball flavor of the release

TLDR: protobuf-34.1.bazel.tar.gz correctly ids itself as v34.1 but protobuf-34.1.tar.gz thinks it is v33.0. Run the following to see for yourself:

curl -Ls https://github.com/protocolbuffers/protobuf/releases/download/v34.1/protobuf-34.1.bazel.tar.gz | \
  tar -O -xzf - protobuf-34.1/bazel/private/oss/toolchains/prebuilt/tool_integrity.bzl | grep "RELEASE_VERSION"

curl -Ls https://github.com/protocolbuffers/protobuf/releases/download/v34.1/protobuf-34.1.tar.gz | \
  tar -O -xzf - protobuf-34.1/bazel/private/oss/toolchains/prebuilt/tool_integrity.bzl | grep "RELEASE_VERSION"

What version of protobuf and what language are you using?

Version: 33.4, 33.6, 34.1 (affects all recent releases)
Language: Bazel / Java (specifically affecting legacy WORKSPACE builds)

What supported operating system version are you using (e.g. Linux, Windows) ?

Linux / macOS (any OS running Bazel)

What supported runtime / compiler version are you using (e.g. python version, gcc version)

Bazel 7.x, 8.x

What did you do?

1. Configure a Bazel project in legacy WORKSPACE mode (Bzlmod disabled) using Protobuf 33.4, 33.6, or 34.1 by downloading the standard release source archive (.tar.gz) from the GitHub Releases assets:

# WORKSPACE
http_archive(
    name = "com_google_protobuf",
    sha256 = "bc670a4e34992c175137ddda24e76562bb928f849d712a0e3c2fb2e19249bea1",
    strip_prefix = "protobuf-33.4",
    urls = ["https://github.com/protocolbuffers/protobuf/releases/download/v33.4/protobuf-33.4.tar.gz"],
)
load("@com_google_protobuf//:protobuf_deps.bzl", "protobuf_deps")
protobuf_deps()

2. Enable the prebuilt protoc and toolchain resolution in .bazelrc:

common --@com_google_protobuf//bazel/toolchains:prefer_prebuilt_protoc
common --incompatible_enable_proto_toolchain_resolution

3. Run a build that compiles any proto_library (e.g. bazel build //...).

What did you expect to see

Bazel should download the pre-compiled protoc binary that matches the repository version, and the authenticity check (ProtocAuthenticityCheck) should pass and the build should succeed.

What did you see instead?

The build fails during the ProtocAuthenticityCheck action with the following error:

ERROR: protoc version does not match protobuf Bazel module; we do not support this.
       Expected: libprotoc 33.0
       Actual:   libprotoc 33.4

Diagnosis & Anything else we should know about your project / environment

This error is caused by a packaging mismatch between the two release archives uploaded for each version:

1. Bzlmod Archive (protobuf-X.Y.bazel.tar.gz): This archive has RELEASE_VERSION replaced with its actual release version (e.g., `RELEASE_VERSION= "v33.4" in tool_integrity.bzl).
2. Standard Source Archive (protobuf-X.Y.tar.gz): This archive has not been updated with its actual version, leaving the checked-in test placeholder RELEASE_VERSION = _TEST_VERSION (hard coded to "v33.0")

Start by inspecting bazel/private/oss/toolchains/prebuilt/tool_integrity.bzl in the standard release archive and compare it with the corresponding .bazel archive. Reproduce the failure with the WORKSPACE configuration and a proto_library build using Bazel 7 or 8. Done means the standard archive carries its release version and ProtocAuthenticityCheck passes.