feat(local): just rebuild recipe for targeted builds via remote buildx (#87)

## Summary

Adds a local `just rebuild` recipe to (re)build specific versions of a single package on a given OS/arch, dispatching to a remote buildx builder (the build runs there, not locally).

- `just rebuild <os> <tag> <arch> <package> <version>...` → `docker buildx build --builder <artemis|gaia> --platform linux/<arch> …` (amd64→artemis, arm64→gaia; names + `R_VERSION` env-overridable).
- `docker/build-one.Dockerfile` runs `build-one.R` as a secret-mounted `RUN`, built `--no-cache --output type=cacheonly` (pure side-effect: the S3 upload; no image kept).
- `local/build-one.R` auto-classifies each version via the ABI classifier (risky → per-minor slot `contrib/<x.y>/`, else generic), force-rebuilds + uploads + stores metadata, then refreshes the touched slot's `PACKAGES` index.

## Prerequisites

- buildx builders named `artemis` (amd64) and `gaia` (arm64) registered (`docker buildx create --name artemis ssh://…`).
- Exported secrets: `B2_S3_ACCESS_KEY`, `B2_S3_SECRET_KEY`, `PGPASS` (`GITHUB_PAT` optional).
- bincraft `v4.2.0` tag must exist (the build installs `@v4.2.0` and uses its classifier + per-minor index API).

Reviewed-on: #87

docker/build-one.Dockerfile

@@ -0,0 +1,32 @@
+# syntax=docker/dockerfile:1
+# Targeted (re)build of specific package versions, executed on a remote buildx
+# builder. The build's effect is the S3 upload performed by build-one.R; no
+# image is kept (the justfile uses --output type=cacheonly). CACHEBUST forces
+# the RUN to re-execute on every invocation.
+#
+# Build context is `local/` (see the `rebuild` recipe in the justfile).
+ARG OS
+ARG OS_VERSION
+FROM reg.devxy.io/rpkgs/build-env-${OS}:${OS_VERSION}
+
+ARG R_VERSION=4.5.3
+ARG PACKAGE
+ARG VERSIONS
+ARG CACHEBUST
+
+WORKDIR /work
+COPY build-one.R /work/build-one.R
+
+RUN --mount=type=secret,id=b2_access,required=true \
+    --mount=type=secret,id=b2_secret,required=true \
+    --mount=type=secret,id=pgpass,required=true \
+    --mount=type=secret,id=github_pat,required=false \
+    export B2_S3_ACCESS_KEY="$(cat /run/secrets/b2_access)" && \
+    export B2_S3_SECRET_KEY="$(cat /run/secrets/b2_secret)" && \
+    export PGPASS="$(cat /run/secrets/pgpass)" && \
+    export GITHUB_PAT="$(cat /run/secrets/github_pat 2>/dev/null || true)" && \
+    /opt/R/${R_VERSION}/bin/R -q -e 'if (!requireNamespace("bincraft", quietly = TRUE) || packageVersion("bincraft") != "4.2.0") pak::pak("git::https://codefloe.com/rpkgs/bincraft.git@v4.2.0")' && \
+    XVFB=$(command -v xwfb-run 2>/dev/null || command -v xvfb-run); \
+    XVFB_ARGS=""; \
+    if command -v xwfb-run >/dev/null 2>&1; then dnf install -y -q weston 2>/dev/null; XVFB_ARGS="-c weston"; fi; \
+    $XVFB $XVFB_ARGS -- /opt/R/${R_VERSION}/bin/Rscript /work/build-one.R "${PACKAGE}" ${VERSIONS}