Fix arm64 cross-build headers failure and installer error reporting

Follow-up fixes from adversarial verification of the Gitea adaptation:

- build.yml: arm64 `bindeb-pkg` cross build aborted on the linux-headers
  package because CONFIG_MODULE_SIG_FORMAT=y makes it cross-compile
  scripts/sign-file, which needs arm64 OpenSSL dev headers that aren't
  installed. Pass DEB_BUILD_PROFILES=pkg.linux-upstream.nokernelheaders on
  the arm64 make line (the maintainers' documented remedy) so the arm64
  release publishes an image package without the unbuildable headers deb.
- install.sh: api_get used `curl -fsSL`, which discards the HTTP error body,
  so Gitea's {"message":...} never reached check_release_api_response and the
  token/permission hint was dead on 401/403/404. Drop -f (keep -sSL) so the
  error JSON is surfaced; network-layer failures still exit non-zero.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/build.yml

@@ -241,7 +241,12 @@ jobs:
           CROSS_COMPILE: ${{ matrix.cross_compile }}
         run: |
           if [ "$TARGET_ARCH" = "arm64" ]; then
-            make ARCH=arm64 CROSS_COMPILE="$CROSS_COMPILE" bindeb-pkg -j$(nproc) LOCALVERSION="$LOCALVERSION_SUFFIX" KDEB_COMPRESS=gzip skipdbg=true
+            # Drop the linux-headers package on the arm64 cross build: with
+            # CONFIG_MODULE_SIG_FORMAT=y its packaging cross-compiles scripts/sign-file
+            # and would need arm64 OpenSSL dev headers (libssl-dev:arm64) we don't
+            # install. nokernelheaders is the kernel maintainers' documented remedy.
+            DEB_BUILD_PROFILES=pkg.linux-upstream.nokernelheaders \
+              make ARCH=arm64 CROSS_COMPILE="$CROSS_COMPILE" bindeb-pkg -j$(nproc) LOCALVERSION="$LOCALVERSION_SUFFIX" KDEB_COMPRESS=gzip skipdbg=true
           else
             make bindeb-pkg -j$(nproc) LOCALVERSION="$LOCALVERSION_SUFFIX" KDEB_COMPRESS=gzip skipdbg=true
           fi