Fix PR review comments: service flags, DATA_DIR, version pinning, upgrade safety

- Remove --setup flag from systemd service and CI (not valid in 0.9.x)
- Remove release triggers from debian/homebrew workflows (handled by release.yml)
- Fix brew post_install to set DATA_DIR so it initializes in var/archivebox
- Add PATH export to deb wrapper script for bundled console scripts
- Remove pip install fallback in install.sh (strict version pinning)
- Guard preremove.sh cleanup to only run on remove/purge, not upgrade
- Initialize SDIST_URL/SDIST_SHA256 in build_brew.sh (nounset safety)
- Pin awalsh128/cache-apt-pkgs-action to v1.6.0 (supply chain safety)

https://claude.ai/code/session_01Vx1EsNrNySgsc8Y67dGzCn

brew_dist/archivebox.rb

@@ -40,7 +40,8 @@ class Archivebox < Formula
 
   def post_install
     # Install runtime dependencies (plugins, JS extractors, etc.)
-    system bin/"archivebox", "install", "--binproviders", "pip,npm"
+    (var/"archivebox").mkpath
+    system({ "DATA_DIR" => var/"archivebox" }, bin/"archivebox", "install", "--binproviders", "pip,npm")
   end
 
   service do