ci: fix DOWNLOAD_FILE expansion for rootfs builds

f6d7df9 ("ci: select only correct targz for rootfs build") builds the
rootfs archive name with ${TARGET//\//-}, but the heredoc generating
the build args is single-quoted, so the substitution never happens.
The literal openwrt-${TARGET_TAG}-rootfs.tar.gz then reaches setup.sh.

grep finds no match, leaving file_name empty and causing the
verification to check the entire sha256sums file. Every rootfs job
has since failed with "12414 listed files could not be read".

Expand the target tag in the shell before generating the args, while
keeping DOWNLOAD_FILE as a pattern: release branches embed the
version and revision in the filename, and malta/be has a -default-
profile infix. The pattern must also exclude targz- image variants.

Verified to match exactly one file for all eight rootfs targets on
both snapshots and releases/24.10-SNAPSHOT.

Make setup.sh fail loudly when the pattern matches nothing instead of
producing the misleading checksum error.

.github/workflows/containers.yml

@@ -470,10 +470,10 @@ jobs:
       - name: Generate build args
         id: build_args
         run: |
-          echo 'args<<EOF
-            TARGET=${{ matrix.target }}
-            TARGET_TAG="${TARGET//\//-}"
-            DOWNLOAD_FILE=openwrt-${TARGET_TAG}-rootfs.tar.gz
+          TARGET='${{ matrix.target }}'
+          echo "args<<EOF
+            TARGET=$TARGET
+            DOWNLOAD_FILE=openwrt-.*${TARGET//\//-}-\(default-\)\?rootfs.tar.gz
             WORKDIR=/
             USER=root
             VERSION_PATH=${{ needs.generate_matrix.outputs.version_path }}
@@ -481,7 +481,7 @@ jobs:
             CMD=ash
             FILE_HOST=${{ needs.generate_matrix.outputs.file_host }}
             RUN_SETUP=${{ needs.generate_matrix.outputs.run_setup }}
-          EOF' >> $GITHUB_OUTPUT
+          EOF" >> $GITHUB_OUTPUT
 
       - name: Build
         id: build

setup.sh

@@ -16,6 +16,11 @@ gpg --with-fingerprint --verify sha256sums.asc sha256sums
 # determine archive name
 file_name="$(grep "$DOWNLOAD_FILE" sha256sums | cut -d "*" -f 2)"
 
+if [ -z "$file_name" ]; then
+	echo "No file matching '$DOWNLOAD_FILE' found in sha256sums" >&2
+	exit 1
+fi
+
 # download imagebuilder/sdk archive
 wget -nv "$FILE_HOST/$DOWNLOAD_PATH/$file_name"