fix: properly import OpenTofu GPG key with dearmor

Issue:
- OpenTofu installation fails with GPG error
- Error: 'signatures couldn't be verified because the public key is not available'
- NO_PUBKEY 70DF59811A8B9109

Root cause:
- GPG key was not being dearmored before saving
- apt requires dearmored (.gpg) format, not ASCII-armored

Fix:
- Pipe GPG key through 'gpg --dearmor' before saving
- Use same pattern as Docker GPG key (which worked successfully)
- curl | gpg --batch --yes --dearmor -o /etc/apt/keyrings/opentofu.gpg

Result:
- ✅ GPG key properly imported in binary format
- ✅ apt can verify the repository signatures
- ✅ OpenTofu installation will succeed