fix(packaging): address review findings for #44

- nfpm.yaml: type:config → config_noreplace (RPM noreplace semantics)
- nfpm.yaml: type:ghost → type:dir for /var/lib/fenris (deb compatibility)
- postinst.sh/rpm/post.sh: fix timer restart — capture running unit before
  daemon-reload so the diff actually detects changes
- README: fix Python floor to ≥3.10 (was ≥3.9, inconsistent with Makefile)
- signing-key-ceremony.md: fix stale claim about nfpm signing RPMs
  (actual path is post-build rpmsign)
- tests/conftest.py: extract shared _get_version() and _read() helpers
- tests: wire up to shared conftest helpers
- release.yml: extract VERSION once via GITHUB_OUTPUT step

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>

.gitea/workflows/release.yml

@@ -35,11 +35,15 @@ jobs:
       - name: Generate and clearsign SHA256SUMS
         run: make clearsign
 
+      - name: Determine version
+        id: version
+        run: echo "version=$(sed -n 's/^version = "\(.*\)"/\1/p' pyproject.toml)" >> "$GITHUB_OUTPUT"
+
       - name: Upload deb packages to registry
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
         run: |
-          VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' pyproject.toml)
+          VERSION=${{ steps.version.outputs.version }}
           DEB="fenris_${VERSION}_amd64.deb"
           for CODENAME in bookworm jammy noble; do
             curl --fail -X PUT \
@@ -52,7 +56,7 @@ jobs:
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
         run: |
-          VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' pyproject.toml)
+          VERSION=${{ steps.version.outputs.version }}
           RPM="fenris-${VERSION}-1.x86_64.rpm"
           curl --fail -X PUT \
             -u "xavierk:${GITEA_TOKEN}" \
@@ -63,7 +67,7 @@ jobs:
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
         run: |
-          VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' pyproject.toml)
+          VERSION=${{ steps.version.outputs.version }}
           # Check if release already exists (idempotent re-runs)
           EXISTING=$(curl -s -o /dev/null -w '%{http_code}' \
             -u "xavierk:${GITEA_TOKEN}" \
@@ -82,7 +86,7 @@ jobs:
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
         run: |
-          VERSION=$(sed -n 's/^version = "\(.*\)"/\1/p' pyproject.toml)
+          VERSION=${{ steps.version.outputs.version }}
           # Get release ID for this tag
           RELEASE_ID=$(curl -s \
             -u "xavierk:${GITEA_TOKEN}" \