feat(packaging): nfpm-based deb + rpm build infrastructure (spec §3-7, ADR 0007)

Implement the packaging configuration, staging script, maintainer scripts,
and container test harness for building native deb and rpm packages.

Core files:
- packaging/nfpm.yaml: single source of truth for both formats
- packaging/stage.sh: builds staged tree (venv, wrapper, helpers, units, polkit, sysusers, tmpfiles)
- packaging/fenris.conf: placeholder-commented default configuration
- packaging/postinst.sh, prerm.sh, postrm.sh: POSIX-compatible deb maintainer scripts
- packaging/rpm/post.sh, preun.sh, postun.sh: RPM scriptlets
- packaging/sysusers.d/fenris.conf, tmpfiles.d/fenris.conf: systemd fragments
- packaging/fenris.repo: dnf consumer setup
- packaging/keys/fenris-packaging.asc: public key placeholder

Build targets added to Makefile: stage, package-deb, package-rpm, package, release, clean.
Container test harness in tests/test_packaging.py covering dormant install,
migration guard, upgrade semantics, and removal semantics across the
compatibility matrix (Debian 12, Ubuntu 22.04/24.04, Fedora 40).
Dormant CI workflow at .gitea/workflows/release.yml.

All 289 existing tests pass without regression.

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>

Makefile

@@ -17,7 +17,7 @@ MANIFEST := $(DATA_DIR)/manifest.txt
 # Legacy history path (IN-4)
 LEGACY_HISTORY := ./data/history.jsonl
 
-.PHONY: help install upgrade uninstall purge update-deps test lint check-python check-smartctl import-legacy
+.PHONY: help install upgrade uninstall purge update-deps test lint check-python check-smartctl import-legacy stage package-deb package-rpm package release clean
 
 help:
 	@echo "Fenris NVMe endurance monitor"
@@ -30,6 +30,12 @@ help:
 	@echo "  test         - Run tests"
 	@echo "  lint         - Run linter"
 	@echo "  update-deps  - Update dependency pins"
+	@echo "  stage        - Stage packaging tree for nfpm"
+	@echo "  package      - Build deb + rpm packages"
+	@echo "  package-deb  - Build deb package only"
+	@echo "  package-rpm  - Build rpm package only"
+	@echo "  release      - Full release (build, sign, attach)"
+	@echo "  clean        - Remove build artifacts"
 
 # ─── Pre-install gates ──────────────────────────────────────────────────────
 
@@ -216,3 +222,50 @@ lint:
 
 update-deps:
 	$(PYTHON) -m pip compile pyproject.toml -o requirements.txt
+
+# ─── Packaging (spec §3, §5) ────────────────────────────────────────────────
+
+# Version is sourced from pyproject.toml for both formats
+FENRIS_VERSION := $(shell sed -n 's/^version = "\(.*\)"/\1/p' pyproject.toml)
+
+stage: dist/fenris-*.whl
+	@echo "=== Staging packaging tree (v$(FENRIS_VERSION)) ==="
+	bash packaging/stage.sh "$(FENRIS_VERSION)"
+
+package-deb: stage
+	@echo "=== Building deb package ==="
+	VERSION="$(FENRIS_VERSION)" nfpm pkg -f packaging/nfpm.yaml -p deb -t dist/
+	@echo "=== deb package built: dist/fenris_$(FENRIS_VERSION)_amd64.deb ==="
+
+package-rpm: stage
+	@echo "=== Building rpm package ==="
+	VERSION="$(FENRIS_VERSION)" nfpm pkg -f packaging/nfpm.yaml -p rpm -t dist/
+	@echo "=== rpm package built: dist/fenris-$(FENRIS_VERSION)-1.x86_64.rpm ==="
+
+package: package-deb package-rpm
+	@echo "=== Both packages built in dist/ ==="
+
+release: package
+	@echo "=== Release v$(FENRIS_VERSION) ==="
+	@echo "Artifacts:"
+	@ls -la dist/fenris_$(FENRIS_VERSION)_amd64.deb dist/fenris-$(FENRIS_VERSION)-1.x86_64.rpm 2>/dev/null
+	@echo ""
+	@echo "Manual steps (spec §5):"
+	@echo "  1. Import packaging key:  gpg --import <keyfile>"
+	@echo "  2. Sign RPM payload:      rpmsign --addsign dist/fenris-$(FENRIS_VERSION)-1.x86_64.rpm"
+	@echo "  3. Generate checksums:    cd dist && sha256sum fenris_$(FENRIS_VERSION)_amd64.deb fenris-$(FENRIS_VERSION)-1.x86_64.rpm > SHA256SUMS"
+	@echo "  4. Clearsign manifest:    gpg --clearsign dist/SHA256SUMS"
+	@echo "  5. Upload to registry:"
+	@echo "       curl -X PUT -u user:token -T dist/fenris_$(FENRIS_VERSION)_amd64.deb \\"
+	@echo "         'https://git.bongbetic.com/api/packages/xavierk/debian/pool/bookworm/main/upload'"
+	@echo "       curl -X PUT -u user:token -T dist/fenris_$(FENRIS_VERSION)_amd64.deb \\"
+	@echo "         'https://git.bongbetic.com/api/packages/xavierk/debian/pool/jammy/main/upload'"
+	@echo "       curl -X PUT -u user:token -T dist/fenris_$(FENRIS_VERSION)_amd64.deb \\"
+	@echo "         'https://git.bongbetic.com/api/packages/xavierk/debian/pool/noble/main/upload'"
+	@echo "       curl -X PUT -u user:token -T dist/fenris-$(FENRIS_VERSION)-1.x86_64.rpm \\"
+	@echo "         'https://git.bongbetic.com/api/packages/xavierk/rpm/fenris/upload'"
+	@echo "  6. Create Gitea release with notes and attach .deb, .rpm, SHA256SUMS.asc"
+
+clean:
+	@echo "=== Cleaning build artifacts ==="
+	rm -rf build/stage dist/fenris-*.deb dist/fenris-*.rpm dist/SHA256SUMS*