Previously the ISO file was named after git describe --match 'audit/v*', so a new iso/ tag produced names like v1.0.9-1-gXXXXXXX instead of v1.0.17. Now build.sh has resolve_iso_version() that looks at iso/v* tags separately. The bee binary inside the ISO still uses AUDIT_VERSION_EFFECTIVE. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>