fix(ci): 使用认证的gh CLI替代未认证curl调用GitHub API

download-hub步骤使用未认证的curl获取release列表，
频繁触发GitHub API速率限制导致构建失败。
改用gh CLI自带GITHUB_TOKEN认证避免此问题。

.github/workflows/docker-publish.yml

@@ -184,20 +184,12 @@ jobs:
     steps:
       - name: Get latest hub release tag
         id: hub-tag
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          TAG=$(
-            curl -sL "https://api.github.com/repos/${{ env.GITHUB_REPO }}/releases" | \
-            python3 - <<'PY'
-          import json, sys
-          releases = json.load(sys.stdin)
-          for r in releases:
-              tag = r.get('tag_name', '')
-              if tag.startswith('hub-v') and not r.get('draft') and not r.get('prerelease'):
-                  print(tag)
-                  break
-          PY
-          )
-          if [ -z "$TAG" ]; then
+          TAG=$(gh release list --repo "${{ env.GITHUB_REPO }}" --limit 50 --json tagName,isDraft,isPrerelease \
+            --jq '[.[] | select(.tagName | startswith("hub-v")) | select(.isDraft == false and .isPrerelease == false)] | .[0].tagName')
+          if [ -z "$TAG" ] || [ "$TAG" = "null" ]; then
             echo "No hub release found"
             exit 1
           fi