Depend on the extractor that understands our manifest, and restart on upgrade

fp6-vendor-blobs learned the mbn directive in 1-r2. The extractor before it
exits on an unknown directive, so a fresh flash with 1-r1 and our
20-focal64.manifest processes the audio fragment and then fails the blobs unit
on ours: a red unit, no trustlet, and nothing in the daemon's own logs to say
why. Saying >=1-r2 makes apk refuse a combination that cannot work instead of
installing one that fails at first boot. Existing installs never saw this --
the old fast path only checks file lines and exits before the dispatcher.

apk also swaps the binary on disk and leaves the running daemon alone, which is
how 0.2.2's FingerMatched signal first presented: a clean MATCH in the journal
and nothing downstream, because the boot's 0.1.3 was still answering. A
post-upgrade try-restart closes that. A daemon that is not running stays not
running, and a build chroot without systemd is left alone.

0.2.3, so the package CI publishes it.

packaging/APKBUILD

@@ -10,7 +10,7 @@
 # Alpine, so an APKBUILD that compiled from source could not be built by
 # anyone but us either.
 pkgname=fingerprintd
-pkgver=0.2.2
+pkgver=0.2.3
 pkgrel=0
 pkgdesc="Fingerprint daemon for the Fairphone 6 (FocalTech FT9391 behind QTEE)"
 url="https://forgejo.catcrafts.net/Catcrafts/fingerprintd"
@@ -30,7 +30,10 @@ license="GPL-3.0-only"
 # trustlet out of the stock modem partition on first boot. Without it there is
 # no matcher and the unit stays inert on its ConditionPathExists -- so this is
 # a real dependency, not a nicety. It is an FP6 device package; so is this.
-depends="dbus glib libc++ fprintd-pam fp6-vendor-blobs"
+# The mbn directive the fragment uses arrived in 1-r2; the extractor before it
+# exits on an unknown directive, which on a first boot would fail the blobs
+# unit after the audio fragment had run and before this one could.
+depends="dbus glib libc++ fprintd-pam fp6-vendor-blobs>=1-r2"
 # The versioned provides both satisfies plasma-workspace's fprintd dependency
 # — its Users KCM is the fingerprint enrolment UI and speaks exactly this bus
 # name — and EXCLUDES the real package, which is required rather than tidy:
@@ -52,6 +55,9 @@ subpackages="$pkgname-agent $pkgname-systemd"
 # traced against an x86_64 build host
 options="!check !tracedeps"
 source="fingerprintd-$pkgver.tar.gz"
+# apk swaps the binary on disk and leaves the running daemon alone; the
+# script restarts it so an upgrade does not leave the old code answering.
+install="$pkgname.post-upgrade"
 
 package() {
 	cd "$srcdir/fingerprintd-$pkgver"