fix: GPG key dearmoring using proper stdin/stdout redirection

CRITICAL FIX: GPG key import was failing silently causing NO_PUBKEY errors

Root Cause:
- Previous: gpg --dearmor -o output.gpg input.gpg (file argument)
- GPG expects stdin by default, not file arguments
- Commands were succeeding but creating empty/invalid key files
- apt couldn't verify signatures: NO_PUBKEY 70DF59811A8B9109

Fix Applied:
- Use stdin/stdout redirection: gpg --dearmor < input > output
- Add verification: Check files are not empty after download/dearmor
- Add detailed error messages with exit on failure
- Add progress logging for debugging
- Handle both root and sudo cases properly

Changes:
1. Docker GPG key:
   - Download verification (file must exist and not be empty)
   - Dearmor with proper redirection: < input > output
   - Post-dearmor verification
   - Detailed error messages

2. OpenTofu GPG key:
   - Same fixes as Docker
   - Explicit logging at each step
   - Fail fast with clear error messages

Why stdin/stdout redirection works:
- gpg --dearmor reads from stdin by default
- < file redirects file content to stdin
- > file redirects stdout to file
- No function calls in the middle to break the stream
- Works reliably in all shells and environments

Testing:
- Verify /etc/apt/keyrings/*.gpg files are created
- Verify files are not empty: ls -lh /etc/apt/keyrings/
- Verify apt-get update succeeds without GPG errors
- Check for NO_PUBKEY errors (should be gone)

Result:
- ✅ GPG keys properly imported in binary format
- ✅ apt can verify repository signatures
- ✅ Docker and OpenTofu installations will succeed
- ✅ Clear error messages if download/conversion fails