Depend on the extractor that understands our manifest, and restart on upgrade

fp6-vendor-blobs learned the mbn directive in 1-r2. The extractor before it
exits on an unknown directive, so a fresh flash with 1-r1 and our
20-focal64.manifest processes the audio fragment and then fails the blobs unit
on ours: a red unit, no trustlet, and nothing in the daemon's own logs to say
why. Saying >=1-r2 makes apk refuse a combination that cannot work instead of
installing one that fails at first boot. Existing installs never saw this --
the old fast path only checks file lines and exits before the dispatcher.

apk also swaps the binary on disk and leaves the running daemon alone, which is
how 0.2.2's FingerMatched signal first presented: a clean MATCH in the journal
and nothing downstream, because the boot's 0.1.3 was still answering. A
post-upgrade try-restart closes that. A daemon that is not running stays not
running, and a build chroot without systemd is left alone.

0.2.3, so the package CI publishes it.

packaging/build-package.sh

@@ -94,6 +94,8 @@ PKG="$HOME/pkg"
 rm -rf "$PKG"
 mkdir -p "$PKG"
 cp "$SRC/packaging/APKBUILD" "$PKG/APKBUILD"
+# install= scripts are read from the aport dir, not from source=
+cp "$SRC/packaging/fingerprintd.post-upgrade" "$PKG/"
 mv "fingerprintd-$VER.tar.gz" "$PKG/"
 sed -i "s/^pkgver=.*/pkgver=$VER/" "$PKG/APKBUILD"
 # a throwaway signing key: phones trust the registry-signed APKINDEX, not