fix(packaging): address review findings for #44

- nfpm.yaml: type:config → config_noreplace (RPM noreplace semantics)
- nfpm.yaml: type:ghost → type:dir for /var/lib/fenris (deb compatibility)
- postinst.sh/rpm/post.sh: fix timer restart — capture running unit before
  daemon-reload so the diff actually detects changes
- README: fix Python floor to ≥3.10 (was ≥3.9, inconsistent with Makefile)
- signing-key-ceremony.md: fix stale claim about nfpm signing RPMs
  (actual path is post-build rpmsign)
- tests/conftest.py: extract shared _get_version() and _read() helpers
- tests: wire up to shared conftest helpers
- release.yml: extract VERSION once via GITHUB_OUTPUT step

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>

packaging/postinst.sh

@@ -26,19 +26,24 @@ n = migrate_to_latest(Path('${STORE_DB}'))
 print(f'Fenris migration: {n} step(s) applied') if n else None
 " 2>&1 || echo "Fenris: migration skipped (store not yet initialized)"
             fi
-            systemctl daemon-reload 2>/dev/null || true
-            # Restart timer only if unit contents changed AND active (spec §7)
+            # Capture running unit content BEFORE daemon-reload (spec §7)
+            RUNNING_UNITS=""
             for unit in fenris-collect.timer; do
                 if systemctl is-active --quiet "${unit}" 2>/dev/null; then
-                    TMPFILE="$(mktemp)"
-                    systemctl cat "${unit}" > "${TMPFILE}" 2>/dev/null || true
-                    UNIT_PATH="/usr/lib/systemd/system/${unit}"
-                    if ! diff -q "${TMPFILE}" "${UNIT_PATH}" > /dev/null 2>&1; then
-                        systemctl restart "${unit}" 2>/dev/null || true
-                    fi
-                    rm -f "${TMPFILE}"
+                    RUNNING_UNITS="${RUNNING_UNITS} ${unit}"
                 fi
             done
+            systemctl daemon-reload 2>/dev/null || true
+            # Restart timer only if unit contents changed AND active
+            for unit in ${RUNNING_UNITS}; do
+                OLD_CONTENT="$(mktemp)"
+                NEW_PATH="/usr/lib/systemd/system/${unit}"
+                systemctl cat "${unit}" > "${OLD_CONTENT}" 2>/dev/null || true
+                if ! diff -q "${OLD_CONTENT}" "${NEW_PATH}" > /dev/null 2>&1; then
+                    systemctl restart "${unit}" 2>/dev/null || true
+                fi
+                rm -f "${OLD_CONTENT}"
+            done
         fi
         # sysusers, tmpfiles, daemon-reload (both fresh install and upgrade)
         systemd-sysusers  || true