fix(ci): pass the metadata DB to per-minor reindexes and fail on errors (#234)

Step 1 of rpkgs/bincraft#211: pass the metadata database explicitly so bincraft can drop its implicit production defaults.

## Changes

- Pass `metadata_db_*` explicitly to every per-minor `upload_package_index()` call in `reindex.yaml`, `process-updates.yaml`, `weekly-rebuild-reindex.yaml`, `build-all-versions.yaml` and `prune-stale-flat-binaries.yaml`.
- Replace `|| true` in those per-minor loops with a list of failed minors: every minor is still attempted, then the step exits 1 naming the ones that failed.
- Give the "Upload package indexes" step of `build-all-versions.yaml` the `PGPASS` secret. It never had it, so its per-minor reindexes always aborted and `|| true` hid that.
- Run the CDN purge in `process-updates.yaml` and `prune-stale-flat-binaries.yaml` even when a reindex failed, as `reindex.yaml` and `weekly-rebuild-reindex.yaml` already do, because the generic index was still replaced.
- `local/repair-built-stamp.R` passes the database too, and fails once all minors are tried instead of only printing the error.

The generic (non-per-minor) calls are unchanged: they never read the database.

## Behaviour change

A per-minor reindex that fails now turns the pipeline red instead of passing silently.
Expect build-all-versions runs to start reindexing per-minor slots for real, since they now have the password.

## Ordering

Merge this before rpkgs/bincraft's companion PR is released: `local/install-bincraft.R` installs the latest bincraft tag, and the explicit arguments work with both the current and the next release.

Reviewed-on: #234

README.md

@@ -139,6 +139,7 @@ For Alpine, no rules existed until recently, establishing a foundation for semi-
 
 The build metadata is stored in a PostgreSQL database.
 The database has a public endpoint at `r-binaries.devxy.io` and port `15432`.
+It serves a Let's Encrypt certificate for that name, so connect with `sslmode=verify-full`; from R, pass `sslrootcert = bincraft::postgres_sslrootcert("verify-full")` as well, since libpq does not read the system trust store by default.
 It contains one table named `single_builds`, which holds the build metadata for each package:
 
 | package_name | tag | platform | error_occurred | build_timestamp | build_duration | error | size | removed |