v1.0.1 — fix install-blocking GPG fingerprint

Fixed (critical)

• SINGBOX_APT_KEY_FPR was a placeholder value in v1.0.0 that did not match the real Sagernet GPG key bundle. Every real install would have died at phase_install_singbox with a fingerprint mismatch. This bug was not caught by --dry-run because dry-run intentionally skips the GPG check. Verified against the live https://sing-box.app/gpg.key on Ubuntu 24.04 LTS.
• phase_verify ran live checks in --dry-run mode, producing fake-looking failures and a non-zero installer exit even though nothing had been installed. Now correctly no-ops in dry-run.
• GPG verification logic now requires the pinned fingerprint to be present anywhere in the bundle rather than to be the first fingerprint — Sagernet bundles a primary key plus a signing subkey, so the first-fingerprint check was fragile against subkey rotation.

Upgrade

bash <(curl -fsSL https://raw.githubusercontent.com/tytsxai/reality-resi-stack/v1.0.1/install/install.sh) \
  --node-name "US-Resi-01" \
  --sni addons.mozilla.org \
  --with-subscription

If you already cloned v1.0.0, just git -C /opt/reality-resi-stack pull --tags && git -C /opt/reality-resi-stack checkout v1.0.1 then re-run the installer (it is idempotent).

v1.0.0 withdrawal

v1.0.0 has been marked withdrawn. It will install nothing on a fresh box because it dies at the GPG check before sing-box is installed — meaning v1.0.0 is harmless to those who tried it, just blocked.