A verify nobody answered is not a failure, and the trustlet is not ours to ship

Two things the packaging left behind.

A verify that ran its 600-frame budget without the sensor being touched was
reported to the client as verify-unknown-error. Nothing had gone wrong: nobody
had pressed. It cost three verifications during packaging, each reading as a
broken daemon. fprintd's contract is that a verify runs until the client stops
it, so the frame cap bounds one trustlet scan session rather than the user's
patience, and a window with no press simply runs again. Verified across the
rollover: 600 frames untouched, "still waiting", then a press matching on its
first contact frame in 44 ms.

Presses that happen and never reach a verdict now report verify-retry-scan --
a bad scan, which fprintd has a word for, and not the matcher saying no.

The cost is that an unanswered verify polls every ~200 ms for as long as the
client holds it. The cure is measured and available -- gpio75 is silent at
idle and bursts on contact -- but it would make the IRQ the only way a press
is ever noticed, deleting the poll under every rate this daemon has been
measured at. Noted where the loop waits, not done.

And the trustlet: focal64.mbn is a proprietary OEM-signed blob, so the package
ships a fp6-vendor-blobs manifest fragment instead, the same mechanism
soc-fairphone-fp6-audio uses for the amp config. It needed a new directive
there -- a QTEE image is an ELF header file plus one payload per program
header, not one file -- and reassembly on the phone reproduces the image QTEE
has accepted since August, byte for byte.

packaging/fingerprintd.service

@@ -16,7 +16,10 @@ ConditionPathExists=/dev/tee0
 # through the SFS root's persist-data/root3 symlinks.
 RequiresMountsFor=/mnt/persist
 Requires=dbus.service
-After=dbus.service
+# fp6-vendor-blobs reassembles the trustlet from the stock modem
+# partition; it runs in sysinit so this ordering already holds, and
+# saying so keeps the ConditionPathExists above from looking arbitrary.
+After=dbus.service fp6-vendor-blobs.service
 
 [Service]
 Type=simple