Tidy the Linux packages and tray after testing on Debian 13

Verified on Debian 13 arm64 with Cinnamon: the .deb installs, the tray
registers and renders its menu, and pull and push sync end to end.

- Packages ship 0755 directories whatever the builder's umask, name the
  native changelog changelog.gz, and override lintian for the static
  binary and the 0640 server config; prerm uses deb-systemd-invoke.
- The tray item is titled KeepOrg for StatusNotifierItem hosts.
- Event log lines omit empty fields.
- -reset-admin help no longer says to stop the server.

Client 0.6.1 (Linux, macOS, Windows, BSD), server 0.12.1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/build-deb.sh

@@ -48,8 +48,24 @@ mkdir -p "$stage/DEBIAN" "$stage/usr/share/doc/$pkg"
 sed -e "s/@VERSION@/$version/" -e "s/@ARCH@/$arch/" \
 	"$root/packaging/deb/$kind/control.in" > "$stage/DEBIAN/control"
 install -m 0644 "$root/packaging/deb/copyright" "$stage/usr/share/doc/$pkg/copyright"
-gzip -9nc "$root/packaging/deb/$kind/changelog" > "$stage/usr/share/doc/$pkg/changelog.Debian.gz"
-chmod 0644 "$stage/usr/share/doc/$pkg/changelog.Debian.gz"
+# A version without a Debian revision is a native package, whose changelog
+# Debian policy names changelog.gz rather than changelog.Debian.gz.
+case $version in
+*-*) changelog=changelog.Debian.gz ;;
+*) changelog=changelog.gz ;;
+esac
+gzip -9nc "$root/packaging/deb/$kind/changelog" > "$stage/usr/share/doc/$pkg/$changelog"
+chmod 0644 "$stage/usr/share/doc/$pkg/$changelog"
+# Go links statically on purpose: one binary, no libc dependency.
+mkdir -p "$stage/usr/share/lintian/overrides"
+printf '%s: statically-linked-binary [usr/bin/%s]\n' "$pkg" "$binary" \
+	> "$stage/usr/share/lintian/overrides/$pkg"
+if [ "$kind" = server ]; then
+	# The config may carry the OIDC client secret, so it is not world-readable.
+	echo "$pkg: non-standard-file-perm 0640 != 0644 [etc/keeporg/server.json]" \
+		>> "$stage/usr/share/lintian/overrides/$pkg"
+fi
+chmod 0644 "$stage/usr/share/lintian/overrides/$pkg"
 
 if [ "$kind" = server ]; then
 	cat > "$stage/DEBIAN/conffiles" <<'CONF'
@@ -90,13 +106,17 @@ POST
 #!/bin/sh
 set -e
 if [ "$1" = remove ] && [ -d /run/systemd/system ]; then
-	systemctl stop keeporgd || true
+	deb-systemd-invoke stop keeporgd.service || true
 fi
 exit 0
 PRERM
 	chmod 0755 "$stage/DEBIAN/postinst" "$stage/DEBIAN/prerm"
 fi
 
+# Whatever the builder's umask, packaged directories are 0755; postinst
+# tightens /etc/keeporg itself.
+find "$stage" -type d -exec chmod 0755 {} +
+
 mkdir -p "$(dirname "$out")"
 fakeroot dpkg-deb --root-owner-group --build "$stage" "$out" >/dev/null
 printf 'built %s (%s %s %s)\n' "$out" "$binary" "$version" "$arch"