feat(local): just rebuild builds across all installed R minors

- Dockerfile: install bincraft into each R minor, run a primary pass plus a
  sensitive-only pass under every other /opt/R/[0-9]* minor (deduped by minor),
  probe/skip xvfb, set GIT_TERMINAL_PROMPT=0; extra-minor failures are non-fatal.
- build-one.R: add --sensitive-only mode, log + shallow-clone the ABI classify
  step, and clear cranlike's stale ./PACKAGES.db before each index refresh
  (workaround for the "table packages already exists" bug; pending cranlike fix).

docker/build-one.Dockerfile

@@ -25,8 +25,36 @@ RUN --mount=type=secret,id=b2_access,required=true \
     export B2_S3_SECRET_KEY="$(cat /run/secrets/b2_secret)" && \
     export PGPASS="$(cat /run/secrets/pgpass)" && \
     export GITHUB_PAT="$(cat /run/secrets/github_pat 2>/dev/null || true)" && \
-    /opt/R/${R_VERSION}/bin/R -q -e 'if (!requireNamespace("bincraft", quietly = TRUE) || packageVersion("bincraft") != "4.2.0") pak::pak("git::https://codefloe.com/rpkgs/bincraft.git@v4.2.0")' && \
-    XVFB=$(command -v xwfb-run 2>/dev/null || command -v xvfb-run); \
+    export GIT_TERMINAL_PROMPT=0 && \
+    export OTEL_SDK_DISABLED=true && \
+    XVFB=$(command -v xwfb-run 2>/dev/null || command -v xvfb-run || true); \
     XVFB_ARGS=""; \
     if command -v xwfb-run >/dev/null 2>&1; then dnf install -y -q weston 2>/dev/null; XVFB_ARGS="-c weston"; fi; \
-    $XVFB $XVFB_ARGS -- /opt/R/${R_VERSION}/bin/Rscript /work/build-one.R "${PACKAGE}" ${VERSIONS}
+    USE_XVFB=0; \
+    if [ -n "$XVFB" ] && $XVFB -a $XVFB_ARGS -- true >/dev/null 2>&1; then \
+      USE_XVFB=1; echo "Using virtual display via $XVFB"; \
+    else \
+      echo "No working virtual display; building without xvfb" >&2; \
+    fi; \
+    run_build() { if [ "$USE_XVFB" = 1 ]; then $XVFB -a $XVFB_ARGS -- "$@"; else "$@"; fi; }; \
+    ensure_bincraft() { "$1" -q -e 'if (!requireNamespace("bincraft", quietly = TRUE) || packageVersion("bincraft") != "4.2.1") pak::pak("git::https://codefloe.com/rpkgs/bincraft.git@v4.2.1")'; }; \
+    PRIMARY_MINOR=$(echo "$R_VERSION" | cut -d. -f1-2); \
+    seen=" $PRIMARY_MINOR "; \
+    prc=0; failed=""; \
+    echo "=== primary pass under R $R_VERSION ==="; \
+    ensure_bincraft /opt/R/${R_VERSION}/bin/R; \
+    run_build /opt/R/${R_VERSION}/bin/Rscript /work/build-one.R "${PACKAGE}" ${VERSIONS} || prc=$?; \
+    for RBIN in /opt/R/*/bin/Rscript; do \
+      [ -x "$RBIN" ] || continue; \
+      RV=$(basename "$(dirname "$(dirname "$RBIN")")"); \
+      case "$RV" in [0-9]*) ;; *) continue ;; esac; \
+      RMINOR=$(echo "$RV" | cut -d. -f1-2); \
+      case "$seen" in *" $RMINOR "*) continue ;; esac; \
+      seen="$seen$RMINOR "; \
+      echo "=== sensitive-only pass under R $RV ==="; \
+      ensure_bincraft "$(dirname "$RBIN")/R"; \
+      run_build "$RBIN" /work/build-one.R --sensitive-only "${PACKAGE}" ${VERSIONS} || failed="$failed $RV"; \
+    done; \
+    if [ -n "$failed" ]; then echo "WARNING: extra-minor build(s) failed (non-fatal; e.g. a version too old to compile on a newer R):$failed" >&2; fi; \
+    if [ "$prc" != 0 ]; then echo "primary pass under R $R_VERSION failed (exit $prc)" >&2; fi; \
+    exit "$prc"

local/build-one.R

@@ -1,15 +1,21 @@
 # Targeted (re)build of specific versions of a single package.
 # Invoked inside a build-env container (see docker/build-one.Dockerfile).
-# Usage: build-one.R <package> <version> [<version> ...]
+# Usage: build-one.R [--sensitive-only] <package> <version> [<version> ...]
 # Sensitivity is auto-detected per version via bincraft's ABI classifier:
 # risky packages go to the per-minor slot, everything else to the generic slot.
+# With --sensitive-only, non-risky versions are skipped (used for the extra
+# per-minor passes under non-primary R versions).
 
-sink(stdout(), type = "message")
 options(crayon.enabled = TRUE, future.globals.onReference = NULL)
 
 args <- commandArgs(trailingOnly = TRUE)
+sensitive_only <- "--sensitive-only" %in% args
+args <- args[args != "--sensitive-only"]
 if (length(args) < 2L) {
-  stop("usage: build-one.R <package> <version> [<version> ...]", call. = FALSE)
+  stop(
+    "usage: build-one.R [--sensitive-only] <package> <version> [<version> ...]",
+    call. = FALSE
+  )
 }
 package <- args[1L]
 versions <- args[-1L]
@@ -32,17 +38,24 @@ classify <- function(pkg, ver) {
   on.exit(unlink(dest, recursive = TRUE, force = TRUE), add = TRUE)
   tryCatch(
     {
+      message(sprintf(
+        "[classify] cloning %s@%s from github.com/cran ...",
+        pkg,
+        ver
+      ))
       system2(
         "git",
         c(
           "clone",
-          "-q",
+          "--depth",
+          "1",
           "--branch",
           ver,
           sprintf("https://github.com/cran/%s", pkg),
           dest
         )
       )
+      message(sprintf("[classify] running ABI classifier on %s ...", pkg))
       isTRUE(as.logical(bincraft::needs_per_minor_recompile(dest)))
     },
     error = function(e) {
@@ -67,6 +80,15 @@ touched_minor <- FALSE
 
 for (ver in versions) {
   sensitive <- classify(package, ver)
+  if (sensitive_only && !sensitive) {
+    message(sprintf(
+      "Skipping %s %s under R %s (not r-minor-sensitive)",
+      package,
+      ver,
+      minor
+    ))
+    next
+  }
   cat(sprintf(
     "Building %s %s (r_minor_sensitive=%s, R %s)\n",
     package,
@@ -101,8 +123,15 @@ for (ver in versions) {
 # Refresh the PACKAGES index for each slot we wrote to, so the (re)built binary
 # is immediately resolvable by clients.
 codename <- bincraft::set_codename(NULL)
+# cranlike keeps a working PACKAGES.db in the CWD; clear any copy left by a
+# previous pass so each per-slot index is built fresh. Otherwise the 2nd index
+# update in the same container fails with "table packages already exists".
+clean_index_workdir <- function() {
+  unlink(c("PACKAGES", "PACKAGES.gz", "PACKAGES.rds", "PACKAGES.db"))
+}
 if (touched_generic) {
   cat("Refreshing generic index\n")
+  clean_index_workdir()
   bincraft::upload_package_index(
     codename = codename,
     s3_endpoint = s3$s3_endpoint,
@@ -114,6 +143,7 @@ if (touched_generic) {
 }
 if (touched_minor) {
   cat(sprintf("Refreshing per-minor index %s\n", minor))
+  clean_index_workdir()
   bincraft::upload_package_index(
     codename = codename,
     r_minor = minor,