s3:release-scripts: fix create-tarball to treat vendor patch level correctly