Fix DEB repo keyring: bundle into deb-repo artifact instead of separate upload

hashFiles() only works with workspace-relative paths, so the condition
hashFiles('/tmp/debs/icl-archive-keyring.gpg') always evaluated to empty,
causing the keyring artifact upload to be silently skipped. This meant
the deploy-pages job could never find the keyring, and the GPG key URL
returned 404.

Fix by copying the keyring into /tmp/apt-repo/ before uploading the
deb-repo artifact, eliminating the need for a separate artifact.

Fixes #33