fix(packaging): address review findings for #44

- nfpm.yaml: type:config → config_noreplace (RPM noreplace semantics)
- nfpm.yaml: type:ghost → type:dir for /var/lib/fenris (deb compatibility)
- postinst.sh/rpm/post.sh: fix timer restart — capture running unit before
  daemon-reload so the diff actually detects changes
- README: fix Python floor to ≥3.10 (was ≥3.9, inconsistent with Makefile)
- signing-key-ceremony.md: fix stale claim about nfpm signing RPMs
  (actual path is post-build rpmsign)
- tests/conftest.py: extract shared _get_version() and _read() helpers
- tests: wire up to shared conftest helpers
- release.yml: extract VERSION once via GITHUB_OUTPUT step

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>

tests/test_release.py

@@ -26,15 +26,14 @@ RELEASE_SCRIPT = REPO_ROOT / "scripts" / "release.sh"
 # ---------------------------------------------------------------------------
 
 def _read(path: str | Path) -> str:
-    return (REPO_ROOT / path).read_text()
+    from tests.conftest import read
+    return read(path)
 
 
 def _get_version() -> str:
     """Extract version from pyproject.toml."""
-    for line in (REPO_ROOT / "pyproject.toml").read_text().splitlines():
-        if line.startswith("version"):
-            return line.split("=")[1].strip().strip('"')
-    raise RuntimeError("Could not determine version from pyproject.toml")
+    from tests.conftest import get_version
+    return get_version()
 
 
 def _run_dry_run(*args: str) -> tuple[int, str]: