fix(packaging): address review findings for #44

- nfpm.yaml: type:config → config_noreplace (RPM noreplace semantics)
- nfpm.yaml: type:ghost → type:dir for /var/lib/fenris (deb compatibility)
- postinst.sh/rpm/post.sh: fix timer restart — capture running unit before
  daemon-reload so the diff actually detects changes
- README: fix Python floor to ≥3.10 (was ≥3.9, inconsistent with Makefile)
- signing-key-ceremony.md: fix stale claim about nfpm signing RPMs
  (actual path is post-build rpmsign)
- tests/conftest.py: extract shared _get_version() and _read() helpers
- tests: wire up to shared conftest helpers
- release.yml: extract VERSION once via GITHUB_OUTPUT step

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>

tests/test_packaging.py

@@ -21,7 +21,6 @@ import pytest
 
 REPO_ROOT = Path(__file__).resolve().parent.parent
 DIST_DIR = REPO_ROOT / "dist"
-VERSION_FILE = REPO_ROOT / "pyproject.toml"
 
 # ---------------------------------------------------------------------------
 # Helpers
@@ -29,10 +28,8 @@ VERSION_FILE = REPO_ROOT / "pyproject.toml"
 
 def _get_version() -> str:
     """Extract version from pyproject.toml."""
-    for line in VERSION_FILE.read_text().splitlines():
-        if line.startswith("version"):
-            return line.split("=")[1].strip().strip('"')
-    raise RuntimeError("Could not determine version from pyproject.toml")
+    from tests.conftest import get_version
+    return get_version()
 
 
 def _docker_available() -> bool: