the agent prints the daemon's version, from the constant the packaging reads

The agent answered --version with "fingerprintd-agent 0.2.2", the string
it was written with, while the daemon's constant went 0.2.3, 0.2.4, 0.2.5:
the subpackage carried the package's version and reported another. The
constant moves from main.cpp into the module both products import, with
its note on what a bump publishes; the two scripts that derive pkgver
from it, the APKBUILD's header and the CI comment name the new file. The
APKBUILD's own pkgver stays a hand-kept copy, which a bump changes too.

interfaces/Fingerprintd.cppm

@@ -12,6 +12,7 @@ the normal world, and reports the matched finger id.
 */
 
 export module Fingerprintd;
+import std;
 export import :Sfs;
 export import :Rpmb;
 export import :Ta;
@@ -20,3 +21,13 @@ export import :Store;
 export import :Tee;
 export import :Sensor;
 export import :Actions;
+
+export namespace fingerprintd {
+    // The release version. The daemon and the agent print it for --version,
+    // and packaging/build-package.sh and packaging/make-bin-tarball.sh read
+    // this line for pkgver, so a bump changes it here and in the APKBUILD and
+    // nowhere else. Bumping it is what publishes a package: the registry
+    // answers 409 for a version it already has, which a build treats as a
+    // no-op.
+    inline constexpr std::string_view Version = "0.2.5";
+}