fix(store): degrade on store permission errors, keep store group-readable (issue #54)

- open_store_readonly(): stat() PermissionError (non-group user on the
  2750 store dir) now maps to StoreFault so status/TUI degrade instead
  of crashing with a traceback.
- init_store(): chmod db + -wal/-shm group rw after WAL setup — SQLite
  WAL readers need write access to sidecars even for mode=ro opens.
- Store dir 2750 → 2770 (tmpfiles + make install) and UMask=002 on the
  collect unit so root-created files stay group-accessible.
- rpm %post upgrade path re-runs systemd-tmpfiles --create to correct
  placement modes on existing machines.
Bump to 0.3.3.

packaging/rpm/post.sh

@@ -44,4 +44,6 @@ print(f'Fenris migration: {n} step(s) applied') if n else None
         fi
         rm -f "${OLD_CONTENT}"
     done
+    # Re-apply placement modes (store dir group access, issue #54)
+    systemd-tmpfiles --create  || true
 fi