fix(store): degrade on store permission errors, keep store group-readable (issue #54)

- open_store_readonly(): stat() PermissionError (non-group user on the
  2750 store dir) now maps to StoreFault so status/TUI degrade instead
  of crashing with a traceback.
- init_store(): chmod db + -wal/-shm group rw after WAL setup — SQLite
  WAL readers need write access to sidecars even for mode=ro opens.
- Store dir 2750 → 2770 (tmpfiles + make install) and UMask=002 on the
  collect unit so root-created files stay group-accessible.
- rpm %post upgrade path re-runs systemd-tmpfiles --create to correct
  placement modes on existing machines.
Bump to 0.3.3.

src/fenris/store.py

@@ -37,10 +37,24 @@ def init_store(store_path: Path) -> sqlite3.Connection:
     Returns a connection to the store.
     """
     conn = sqlite3.connect(str(store_path))
-    
+
     # Enable WAL mode for concurrent reads during writes
     conn.execute("PRAGMA journal_mode=WAL")
-    
+
+    # Group members (fenris group) read the live store read-only, but SQLite
+    # in WAL mode needs write access to the db and its -wal/-shm sidecars even
+    # for readers. Best effort: root-created stores stay group-accessible
+    # without relying on the creating process's umask (issue #54).
+    import os as _os
+    for sidecar in (store_path,
+                    store_path.with_name(store_path.name + "-wal"),
+                    store_path.with_name(store_path.name + "-shm")):
+        try:
+            mode = _os.stat(sidecar).st_mode & 0o777
+            _os.chmod(sidecar, mode | 0o060)
+        except OSError:
+            pass
+
     # Check if this is a new database
     cursor = conn.execute("PRAGMA user_version")
     current_version = cursor.fetchone()[0]