fix: restore recurring credential renewal

[misunders2d]

Summary

• replace broken OnUnitActiveSec=1h renewal schedule with service-inactive-relative recurrence
• add exact owner-reapproved 0.1.45→0.1.46 in-place server upgrade preserving identity, credential, PostgreSQL, endpoint lifecycle, and external prerequisites
• make the Ubuntu upgrade lane prove two real systemd activations plus a later finite NEXT

Verification

• focused timer/exact-upgrade: 10 passed
• setup/recovery: 252 passed
• focused release lane: 458 passed, 5 expected dedicated-PostgreSQL skips
• releasable source corpus: 2105 passed, 21 expected platform/dedicated-PostgreSQL skips
• package metadata check and upgrade shell syntax: PASS

The recursive package/release-manifest assembly remains deliberately pending and fail-closed; this PR does not promote any requirement or gate.

Affected IDs: ID-009, SEC-006, OPS-003, OPS-004, OPS-006.

Linear: MEL-244.