fix: make RPM runtime portable on Tumbleweed

packaging/stage.sh

@@ -5,7 +5,7 @@
 #
 # VERSION defaults to the version in pyproject.toml.
 # The staged tree contains:
-#   /opt/fenris/          — bundled venv with the built wheel
+#   /opt/fenris/vendor/   — bundled pure-Python application dependencies
 #   /usr/bin/fenris       — unprivileged wrapper
 #   /usr/libexec/fenris/  — fenris-monitor, fenris-collect
 #   /usr/lib/systemd/system/ — fenris-collect.{timer,service}
@@ -35,18 +35,23 @@ rm -rf "${STAGE_DIR}"
 mkdir -p "${STAGE_DIR}"
 
 # --- Use pre-built wheel from dist/ ---
-WHEEL=$(ls "${REPO_ROOT}"/dist/fenris-*.whl 2>/dev/null | head -1)
+WHEEL=$(ls "${REPO_ROOT}"/dist/fenris-"${VERSION}"-*.whl 2>/dev/null | head -1)
 if [ -z "${WHEEL}" ]; then
     echo "Error: no wheel found in dist/ — run 'make dist/fenris-*.whl' first" >&2
     exit 1
 fi
 echo "  Using wheel: $(basename "${WHEEL}")"
 
-# --- Create venv with --copies and install wheel ---
-echo "  Creating bundled venv ..."
-python3 -m venv --copies "${STAGE_DIR}/opt/fenris"
-"${STAGE_DIR}/opt/fenris/bin/pip" install --upgrade pip --quiet 2>&1 | tail -1
-"${STAGE_DIR}/opt/fenris/bin/pip" install "${WHEEL}" --quiet 2>&1 | tail -1
+# --- Vendor runtime packages without an interpreter ---
+# A copied Python binary contains an ABI and build-host dynamic-library path.
+# It fails after rolling-distribution Python upgrades (for example Tumbleweed
+# 3.12 -> 3.13).  Fenris and its locked dependencies are pure Python, so place
+# them in a version-neutral directory and execute with the target's python3.
+echo "  Installing version-neutral runtime packages ..."
+VENDOR_DIR="${STAGE_DIR}/opt/fenris/vendor"
+mkdir -p "${VENDOR_DIR}"
+python3 -m pip install --disable-pip-version-check --no-compile \
+    --target "${VENDOR_DIR}" -r "${REPO_ROOT}/requirements.txt" "${WHEEL}"
 
 # --- Inject version into wrapper from pyproject.toml ---
 # The wrapper has a hardcoded version string; patch it for packaging.