fix(packaging): address code review findings

- Upgrade path restarts only fenris-collect.timer, not fenris-collect.service
  (spec §7: "a running oneshot finishes on its old interpreter")
- Remove redundant deb depends override in nfpm.yaml (top-level is sufficient)
- Remove common.sh sourcing — scripts are self-contained to avoid path
  dependency when dpkg/rpm run them from /var/lib/dpkg/info/

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>

packaging/postinst.sh

@@ -1,15 +1,9 @@
 #!/bin/sh
-# postinst — install and upgrade paths (spec §7).
+# postinst — deb install and upgrade paths (spec §7).
 #
 # dpkg calls: postinst configure [most-recently-configured-version]
-#   fresh install: $1 = "configure"
-#   upgrade:       $1 = "configure"  (old version as $2 when available)
-#
-# rpm calls: %post $1 = 1 (fresh install) / 2 (upgrade)
-#   (handled by packaging/rpm/post.sh)
-#
-# Install:  sysusers, tmpfiles, daemon-reload — nothing else (dormant).
-# Upgrade:  snapshot, migration, daemon-reload, conditional timer restart.
+#   fresh install: $1 = "configure", $2 = ""
+#   upgrade:       $1 = "configure", $2 = old version
 set -eu
 
 STORE_DIR="/var/lib/fenris"
@@ -20,13 +14,10 @@ VENV_PYTHON="/opt/fenris/bin/python3"
 case "${1:-}" in
     configure)
         if [ -n "${2:-}" ]; then
-            # Upgrade — $2 is the old version
-            # Snapshot observation store (one generation)
+            # Upgrade — snapshot, migration, daemon-reload, conditional timer restart
             if [ -f "${STORE_DB}" ]; then
                 cp "${STORE_DB}" "${STORE_BAK}" 2>/dev/null || true
             fi
-
-            # Forward-only schema migration
             if [ -x "${VENV_PYTHON}" ] && [ -f "${STORE_DB}" ]; then
                 "${VENV_PYTHON}" -c "
 from fenris.store import migrate_to_latest
@@ -35,9 +26,9 @@ n = migrate_to_latest(Path('${STORE_DB}'))
 print(f'Fenris migration: {n} step(s) applied') if n else None
 " 2>&1 || echo "Fenris: migration skipped (store not yet initialized)"
             fi
-
-            # Restart collect timer only if unit contents changed AND it is active
-            for unit in fenris-collect.timer fenris-collect.service; do
+            systemctl daemon-reload 2>/dev/null || true
+            # Restart timer only if unit contents changed AND active (spec §7)
+            for unit in fenris-collect.timer; do
                 if systemctl is-active --quiet "${unit}" 2>/dev/null; then
                     TMPFILE="$(mktemp)"
                     systemctl cat "${unit}" > "${TMPFILE}" 2>/dev/null || true
@@ -49,7 +40,7 @@ print(f'Fenris migration: {n} step(s) applied') if n else None
                 fi
             done
         fi
-        # Always run on both fresh install and upgrade
+        # sysusers, tmpfiles, daemon-reload (both fresh install and upgrade)
         systemd-sysusers  || true
         systemd-tmpfiles --create  || true
         systemctl daemon-reload  || true