fix(patches): force fs to build vendored static libuv (#111)

## Problem

The `fs` 2.1.0 binary links **system libuv** (`readelf -d fs.so` shows `NEEDED libuv.so.1`).
fs's `configure` prefers system libuv whenever `pkg-config` resolves it, and our build images ship `libuv-devel` (installed as a pak build-time system requirement), so the resulting binary is dynamically linked against `libuv.so.1`.

That binary fails to load on any consumer machine without runtime libuv:

```text
unable to load shared object '.../fs/libs/fs.so':
  libuv.so.1: cannot open shared object file: No such file or directory
```

`install.packages()`/renv do **not** install `SystemRequirements` (only `pak` does, and only inside the build container), so most consumers hit this.
Older fs 1.6.x always vendored libuv, so only the 2.x binaries regressed.
Reproduced in a clean `reg.devxy.io/r/r-alma:4.5-9`.

## Fix

Add `local/patches/fs/force-vendored-libuv.patch`, registered for all platforms.
It short-circuits `configure` to `cp -f src/Makevars.vendor src/Makevars; exit 0` before the pkg-config detection, forcing the bundled static libuv build (`tools/libuv-v1.52.0.tar.gz`, built via cmake).
An env/pkg-config override (`PKG_CONFIG_LIBDIR`) was tried first but the rebuilt binary still linked `libuv.so.1` (the registry `env` tier does not reach fs's configure step), so a source patch is used instead.

## Verification

Built end-to-end inside the real `build-env-redhat:9` image (system libuv present):

- patch fires (`Building static libuv (bincraft: forced vendored)`),
- cmake compiles the vendored libuv,
- resulting `fs.so` has **no `libuv.so.1`** in `NEEDED` (only libR, libstdc++, libm, libgcc_s, libc).

`Rscript local/validate-patches.R` passes (2 entries).
cmake confirmed present in the build-env images.

## Follow-up (not in this PR)

- Rebuild `fs 2.1.0` on every affected platform (rhel8/9/10, ubuntu jammy/noble, alpine 3.22/3.23; amd64 + arm64) and purge the CDN binary paths.
- CDN delivery gap: `purge_cdn_cache.sh` only purges `PACKAGES*`, never package binaries, so rebuilt binaries stay masked until their `.tar.gz` path is purged.

Reviewed-on: #111

local/patches/fs/force-vendored-libuv.patch

@@ -0,0 +1,19 @@
+diff --git a/configure b/configure
+--- a/configure
++++ b/configure
+@@ -11,6 +11,15 @@
+ PKG_TEST_HEADER="<uv.h>"
+ PKG_LIBS="-luv"
+ 
++# bincraft patch: force the vendored static libuv so the resulting binary
++# is self-contained. fs configure otherwise links system libuv whenever
++# pkg-config finds libuv-devel (installed as a build-time sysreq), yielding
++# an fs.so with NEEDED libuv.so.1 that fails to dyn.load on machines lacking
++# runtime libuv (install.packages/renv do not install SystemRequirements).
++echo "Building static libuv (bincraft: forced vendored)" 1>&2
++cp -f src/Makevars.vendor src/Makevars
++exit 0
++
+ # Use pkg-config if available
+ if [ `command -v pkg-config` ]; then
+   PKGCONFIG_CFLAGS=`pkg-config --cflags --silence-errors ${PKG_CONFIG_NAME}`

local/patches/registry.json

@@ -8,5 +8,15 @@
     "makevars": {},
     "patch": "RcppParallel/disable-tbb.patch",
     "reason": "bundled Intel TBB build hangs/fails on musl (Alpine) and newer toolchains (g++ 15 on ubuntu-2604); patch unsets USE_TBB and forces -DRCPP_PARALLEL_USE_TBB=0 so RcppParallel skips the bundled build and uses the TinyThread backend"
+  },
+  {
+    "package": "fs",
+    "versions": "*",
+    "platforms": ["*"],
+    "env": {},
+    "configure_args": [],
+    "makevars": {},
+    "patch": "fs/force-vendored-libuv.patch",
+    "reason": "fs 2.x configure links system libuv whenever pkg-config finds libuv-devel (installed as a build-time sysreq), producing an fs.so with NEEDED libuv.so.1. That binary fails to dyn.load on consumer machines lacking runtime libuv, because install.packages/renv do not install SystemRequirements (only pak does, and only in the build container). The patch short-circuits configure to copy src/Makevars.vendor and build the bundled static libuv (needs cmake) so the binary is self-contained on every platform. An env/pkg-config override was tried first but the rebuilt binary still linked libuv.so.1, so a source patch is used instead."
   }
 ]