CD: fix verify job to work with draft releases

Use `gh release download` instead of public URLs to fetch .deb
assets, since draft releases aren't accessible via the public
releases/download/ path.