Note host sign-in regression for v0.2.1 tag page in the distribution follow-up

TODO.md

@@ -2,9 +2,10 @@
 
 ## Distribution follow-up (host config, no code work)
 
-- [ ] Asset downloads currently require sign-in on the host (`/releases/download/…` redirects to
-      login). Decide with the host admin: open repo visibility / `REQUIRE_SIGNIN_VIEW=false` or
-      accept sign-in-required downloads. Pages and the tag page are already public (HTTP 200).
+- [ ] The host now requires sign-in broadly: `/releases/download/…` AND the `v0.2.1` tag page
+      redirect to login (the `v0.2.0` tag page was public earlier — host config changed). Decide
+      with the host admin: open repo visibility / `REQUIRE_SIGNIN_VIEW=false`, or accept that
+      anonymous users must sign in to browse/download. Repo/CI side is complete.
 
 ## Future Systems (design-level backlog)