Fix arm64 cross-build headers failure and installer error reporting

Follow-up fixes from adversarial verification of the Gitea adaptation:

- build.yml: arm64 `bindeb-pkg` cross build aborted on the linux-headers
  package because CONFIG_MODULE_SIG_FORMAT=y makes it cross-compile
  scripts/sign-file, which needs arm64 OpenSSL dev headers that aren't
  installed. Pass DEB_BUILD_PROFILES=pkg.linux-upstream.nokernelheaders on
  the arm64 make line (the maintainers' documented remedy) so the arm64
  release publishes an image package without the unbuildable headers deb.
- install.sh: api_get used `curl -fsSL`, which discards the HTTP error body,
  so Gitea's {"message":...} never reached check_release_api_response and the
  token/permission hint was dead on 401/403/404. Drop -f (keep -sSL) so the
  error JSON is surfaced; network-layer failures still exit non-zero.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/build.yml

@@ -241,6 +241,11 @@ jobs:
           CROSS_COMPILE: ${{ matrix.cross_compile }}
         run: |
           if [ "$TARGET_ARCH" = "arm64" ]; then
+            # Drop the linux-headers package on the arm64 cross build: with
+            # CONFIG_MODULE_SIG_FORMAT=y its packaging cross-compiles scripts/sign-file
+            # and would need arm64 OpenSSL dev headers (libssl-dev:arm64) we don't
+            # install. nokernelheaders is the kernel maintainers' documented remedy.
+            DEB_BUILD_PROFILES=pkg.linux-upstream.nokernelheaders \
               make ARCH=arm64 CROSS_COMPILE="$CROSS_COMPILE" bindeb-pkg -j$(nproc) LOCALVERSION="$LOCALVERSION_SUFFIX" KDEB_COMPRESS=gzip skipdbg=true
           else
             make bindeb-pkg -j$(nproc) LOCALVERSION="$LOCALVERSION_SUFFIX" KDEB_COMPRESS=gzip skipdbg=true

install.sh

@@ -60,13 +60,15 @@ OOKLA_SPEEDTEST_VERSION="1.2.0"
 
 api_get() {
     local url="$1"
+    # 不加 -f：HTTP >= 400 时保留 JSON 错误体（{"message":...}），交给
+    # check_release_api_response 解析并给出 token 提示；网络层失败仍会非零退出。
     if [[ -n "$GITEA_API_TOKEN" ]]; then
-        curl -fsSL \
+        curl -sSL \
             -H "Authorization: token $GITEA_API_TOKEN" \
             -H "Accept: application/json" \
             "$url"
     else
-        curl -fsSL "$url"
+        curl -sSL "$url"
     fi
 }