The goal is to avoid issues such as #15400: Jenkins had been telling us for
48 hours that the testing branch did not build reproducibly anymore,
but the release manager missed that, built a tentative 3.6 ISO and decided
to release it as-is.

refs: #15400