Fix root symlink follow vulnerability in postinst

Found by the autonomous security review lane of Task 11113 (PR #7325). The issue is outside that task's scope. `packaging/postinst` runs as root. It writes `/var/lib/jaahd/.gitconfig` with `printf >` and then runs `chown jaahd:jaahd /var/lib/jaahd/.gitconfig` (around line 200–210). `/var/lib/jaahd` is `jaahd:jaah 0750`, so the non-root daemon user can replace `.gitconfig` with a symlink. - `chown` without `-h` follows the symlink and hands the target file to `jaahd`, for example `/etc/shadow`. - The `printf >` truncates and overwrites that target as root. - `jaahd` can also choose when this happens: dropping `/run/jaah/requests/upgrade` starts the root updater, which runs postinst. Treat this as a local privilege escalation from `jaahd` to root. Ask: - Never follow a symlink when root writes or chowns inside `/var/lib/jaahd`. Refuse a symlink (remove it and recreate the file), use `chown -h`, or write the git config as the user (`runuser -u jaahd -- git config --file …`). - Audit the other root writes and touches in `/var/lib/jaahd` for the same pattern, such as the marker `touch` calls near lines 285 and 302. Out of scope: the SELinux labelling and the module install, already fixed in #7321/#7325 with the module under root-owned `/etc/jaah/selinux`. Also out of scope: any change to the daemon's own runtime writes. Done means: - A test (stub PATH, as `tools/tests/test_postinst_selinux.py` does) plants a symlink at `/var/lib/jaahd/.gitconfig` that points outside, runs the relevant postinst block, and shows the target is unchanged and not chowned. - `./dc check quick` is green, and the merge lane's full gate is green.

postinst now writes/chmods .gitconfig and touches markers as jaahd (runuser), never following a planted symlink; stub-PATH test proves target untouched. Quick gate green; PR #7333 queued in merge lane. Filed draft #11259 for the same flaw under $JAAH_HOME/auth.