fix(packaging): address review findings for #44

- nfpm.yaml: type:config → config_noreplace (RPM noreplace semantics)
- nfpm.yaml: type:ghost → type:dir for /var/lib/fenris (deb compatibility)
- postinst.sh/rpm/post.sh: fix timer restart — capture running unit before
  daemon-reload so the diff actually detects changes
- README: fix Python floor to ≥3.10 (was ≥3.9, inconsistent with Makefile)
- signing-key-ceremony.md: fix stale claim about nfpm signing RPMs
  (actual path is post-build rpmsign)
- tests/conftest.py: extract shared _get_version() and _read() helpers
- tests: wire up to shared conftest helpers
- release.yml: extract VERSION once via GITHUB_OUTPUT step

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>

packaging/nfpm.yaml

@@ -26,17 +26,17 @@ contents:
     file_info:
       mode: 0755
 
-  # Default placeholder-commented config (conffile for deb)
+  # Default placeholder-commented config (deb conffile / rpm %config(noreplace))
   - src: packaging/fenris.conf
     dst: /etc/fenris/fenris.conf
-    type: config
+    type: config_noreplace
     file_info:
       mode: 0644
 
-  # Observation store directory — owned by package, never packed
-  # deb: created in postinst; rpm: %ghost
+  # Observation store directory — owned by package, never packed.
+  # Store files (observations.db, WAL sidecars, .bak) are never owned.
   - dst: /var/lib/fenris
-    type: ghost
+    type: dir
     file_info:
       mode: 2750
       group: fenris