fetch-release: fix signature verification!

`gpg --verify nar-hash.txt.asc` with a single argument lets gpg pick the
verification mode from the file's packet structure. For a real detached
signature it hashes the sibling nar-hash.txt, but for an inline signed
message it verifies the payload embedded in the .asc itself, never reads
nar-hash.txt, prints "not a detached signature; file was NOT verified!"
and still exits 0. The `&> /dev/null` hid that warning.

helper/fetch-release

@@ -31,7 +31,7 @@ curl -fsS -L -O "$baseUrl/nar-hash.txt"
 curl -fsS -L -O "$baseUrl/nar-hash.txt.asc"
 
 # Verify signature for nar-hash
-gpg --verify nar-hash.txt.asc &> /dev/null || {
+gpg --verify nar-hash.txt.asc nar-hash.txt &> /dev/null || {
     >&2 echo "Error: Signature verification failed. Please open an issue in the project repository."
     exit 1
 }