CRITICAL FIX: Move GPG key installation before first apt-get update

- Move debian-archive-keyring installation to the very beginning
- This must happen before any apt-get update to avoid GPG signature errors
- Install curl after GPG keys are in place
- This fixes the 'repository not signed' error from run #18

The GPG key installation was happening after the first apt-get update,
causing the build to fail early. This reorders the commands correctly.

.forgejo/workflows/ci.yml

@@ -41,9 +41,13 @@ jobs:
           bash -c '
         set -e
         
-        # Install curl first
+        # Add Debian GPG keys FIRST - this must happen before any apt-get update
-        echo "Installing curl..."
+        echo "Adding Debian GPG keys..."
         apt-get update
+        apt-get install -y debian-archive-keyring
+        
+        # Install curl
+        echo "Installing curl..."
         apt-get install -y curl
         
         # Try apt-cacher-ng first, fallback to Debian's automatic mirror selection
@@ -62,11 +66,6 @@ jobs:
           echo "Using httpredir.debian.org for automatic mirror selection"
         fi
         
-        # Add Debian GPG keys
-        echo "Adding Debian GPG keys..."
-        apt-get update
-        apt-get install -y debian-archive-keyring
-        
         # Update and install remaining dependencies
         apt-get update
         apt-get install -y \