release: update-apt-repo uses upload-artifact and hardcodes GPG fingerprint

[levleontiev]

Two bugs in the update-apt-repo job of .github/workflows/release.yml:

1. Wrong action: Download .deb artifact step uses actions/upload-artifact instead of actions/download-artifact — causes the job to fail when trying to fetch the .deb built in build-deb.

2. Hardcoded fingerprint: The Update apt repository step passes 45160BC066817A6E710F7BA0208922A1DA3B0CEC as the GPG key ID. This should be derived dynamically from the imported key so that rotating GPG_PRIVATE_KEY does not require a code change.

Fix

• Replace actions/upload-artifact with actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 in the update-apt-repo job.
• After importing the GPG key, extract the fingerprint with:

  FINGERPRINT=$(gpg --with-colons --list-secret-keys 2>/dev/null | grep '^fpr' | head -1 | cut -d: -f10)

  and pass it to update_apt_repo.sh instead of the hardcoded value.