%dir %attr(0750,wwwrun,root) %{_sysconfdir}/%{name}
%attr(0640,wwwrun,root) %config(noreplace) %{_sysconfdir}/%{name}/config.inc.php

this is wrong

you want root,wwwrun

the php code should not be able to write those files. being able to read them is enough.

supersede declined request with a followup request