Package the daemon, so a fingerprint survives a reflash

An aport, the units, and everything a phone needs to come up with a working
sensor without a single command being run by hand. Verified on the dev phone
across two reboots: modules-load.d loads qcomtee, tmpfiles builds the SFS
root, the mount unit brings up persist, and the daemon is ready 51 seconds
into the boot, owning net.reactivated.Fprint with the enrolled finger
visible.

The packaging shape is the one imsd uses for 81voltd. A versioned
provides="fprintd=..." satisfies plasma-workspace -- its Users KCM is the
enrolment UI and speaks exactly this bus name -- and excludes the real
fprintd, which is not tidiness: fprintd is D-Bus-activatable, so a client
call would otherwise start it and fight us for the name. The cost is the
fprintd-* CLIs, which go with the package.

fprintd-pam is an install_if subpackage pinned to the exact fprintd version,
so the provides breaks its condition and apk purges it -- taking pam_fprintd,
which is the entire point of the daemon, with it. Depending on it explicitly
is what keeps it, and it has no dependency on fprintd itself.

Two things the packaging exposed in the daemon:

The transcript is for experiments, not for a shipped daemon. A file per start
in an unrotated directory, recording the time of every unlock, to say what
the journal already has. It is now opt-in behind --log-dir, which is what
deploy-dev.sh passes since fplearn.sh reads it.

Taking it off the daemon path also took away the setvbuf it was doing as a
side effect of dup2'ing fd 1, and under systemd stdout is a pipe, which means
full buffering: the daemon started, worked, answered D-Bus calls, and printed
nothing. A working daemon that looks hung. stdout is now line-buffered from
the first line of main.

The config ships as generated by fp6fpcfg.py --daemon --verbose, sha256
b205c756914a66f1, because that is the file every accuracy number was measured
on. The quieter variant is untested and switching is a measurement.

The trustlet is not here and never will be: focal64.mbn is a proprietary
OEM-signed blob, and the unit's ConditionPathExists is what keeps the package
inert without it -- as it does on a kernel with no CONFIG_QCOMTEE.

.forgejo/workflows/package.yml

@@ -0,0 +1,66 @@
+name: package
+
+# Builds the fingerprintd apk for aarch64 from the pushed commit and publishes
+# it to the Forgejo Alpine registry — the repo installed phones already point
+# at (via catcrafts-fp6-repo), so a release reaches users through plain
+# 'apk upgrade' without an fp6-img image run.
+#
+# Build: crafter-build cross-compiles against an Alpine aarch64 sysroot
+# (packaging/build-package.sh — the README's "Cross-compiling" flow), the test
+# suite runs natively, and packaging/APKBUILD wraps the result. This needs no
+# privileged runner: it runs in an alpine:edge container on the ordinary
+# arch-latest runner.
+#
+# Release gating is the version: pkgver comes from implementations/main.cpp,
+# the registry answers 409 for an already-published version, and the publish
+# step treats that as "nothing to do" — so pushes only release when the
+# Version constant bumps.
+#
+# Publishing needs PACKAGE_TOKEN (catbot account, package:write scope) — an
+# org-level secret on Catcrafts, shared with imsd and fp6-img; without it the
+# build still runs and the publish step skips quietly.
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [main]
+
+jobs:
+  package:
+    runs-on: arch-latest
+    container:
+      image: alpine:edge
+    timeout-minutes: 90
+    steps:
+      # actions/checkout is a Node action; bare alpine has no node
+      - name: Provision job container
+        run: apk add -q nodejs git curl
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build and package
+        run: ./packaging/build-package.sh
+
+      - name: Publish to the apk registry
+        env:
+          PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
+        run: |
+          if [ -z "$PACKAGE_TOKEN" ]; then
+            echo "no PACKAGE_TOKEN secret configured; skipping package publish"
+            exit 0
+          fi
+          found=0
+          for f in /home/build/.local/share/abuild/*/aarch64/fingerprintd*.apk; do
+            [ -e "$f" ] || continue
+            found=1
+            code=$(curl -s -o /dev/null -w '%{http_code}' \
+              --user "catbot:$PACKAGE_TOKEN" --upload-file "$f" \
+              "https://forgejo.catcrafts.net/api/packages/Catcrafts/alpine/edge/fp6")
+            case "$code" in
+              201) echo "published: $(basename "$f")" ;;
+              409) echo "already published: $(basename "$f")" ;;
+              *)   echo "FAILED ($code): $(basename "$f")"; exit 1 ;;
+            esac
+          done
+          [ "$found" = 1 ] || { echo "no packages found to publish"; exit 1; }