feat(local): just rebuild builds across all installed R minors

- Dockerfile: install bincraft into each R minor, run a primary pass plus a
  sensitive-only pass under every other /opt/R/[0-9]* minor (deduped by minor),
  probe/skip xvfb, set GIT_TERMINAL_PROMPT=0; extra-minor failures are non-fatal.
- build-one.R: add --sensitive-only mode, log + shallow-clone the ABI classify
  step, and clear cranlike's stale ./PACKAGES.db before each index refresh
  (workaround for the "table packages already exists" bug; pending cranlike fix).

local/build-one.R

@@ -1,15 +1,21 @@
 # Targeted (re)build of specific versions of a single package.
 # Invoked inside a build-env container (see docker/build-one.Dockerfile).
-# Usage: build-one.R <package> <version> [<version> ...]
+# Usage: build-one.R [--sensitive-only] <package> <version> [<version> ...]
 # Sensitivity is auto-detected per version via bincraft's ABI classifier:
 # risky packages go to the per-minor slot, everything else to the generic slot.
+# With --sensitive-only, non-risky versions are skipped (used for the extra
+# per-minor passes under non-primary R versions).
 
-sink(stdout(), type = "message")
 options(crayon.enabled = TRUE, future.globals.onReference = NULL)
 
 args <- commandArgs(trailingOnly = TRUE)
+sensitive_only <- "--sensitive-only" %in% args
+args <- args[args != "--sensitive-only"]
 if (length(args) < 2L) {
-  stop("usage: build-one.R <package> <version> [<version> ...]", call. = FALSE)
+  stop(
+    "usage: build-one.R [--sensitive-only] <package> <version> [<version> ...]",
+    call. = FALSE
+  )
 }
 package <- args[1L]
 versions <- args[-1L]
@@ -32,17 +38,24 @@ classify <- function(pkg, ver) {
   on.exit(unlink(dest, recursive = TRUE, force = TRUE), add = TRUE)
   tryCatch(
     {
+      message(sprintf(
+        "[classify] cloning %s@%s from github.com/cran ...",
+        pkg,
+        ver
+      ))
       system2(
         "git",
         c(
           "clone",
-          "-q",
+          "--depth",
+          "1",
           "--branch",
           ver,
           sprintf("https://github.com/cran/%s", pkg),
           dest
         )
       )
+      message(sprintf("[classify] running ABI classifier on %s ...", pkg))
       isTRUE(as.logical(bincraft::needs_per_minor_recompile(dest)))
     },
     error = function(e) {
@@ -67,6 +80,15 @@ touched_minor <- FALSE
 
 for (ver in versions) {
   sensitive <- classify(package, ver)
+  if (sensitive_only && !sensitive) {
+    message(sprintf(
+      "Skipping %s %s under R %s (not r-minor-sensitive)",
+      package,
+      ver,
+      minor
+    ))
+    next
+  }
   cat(sprintf(
     "Building %s %s (r_minor_sensitive=%s, R %s)\n",
     package,
@@ -101,8 +123,15 @@ for (ver in versions) {
 # Refresh the PACKAGES index for each slot we wrote to, so the (re)built binary
 # is immediately resolvable by clients.
 codename <- bincraft::set_codename(NULL)
+# cranlike keeps a working PACKAGES.db in the CWD; clear any copy left by a
+# previous pass so each per-slot index is built fresh. Otherwise the 2nd index
+# update in the same container fails with "table packages already exists".
+clean_index_workdir <- function() {
+  unlink(c("PACKAGES", "PACKAGES.gz", "PACKAGES.rds", "PACKAGES.db"))
+}
 if (touched_generic) {
   cat("Refreshing generic index\n")
+  clean_index_workdir()
   bincraft::upload_package_index(
     codename = codename,
     s3_endpoint = s3$s3_endpoint,
@@ -114,6 +143,7 @@ if (touched_generic) {
 }
 if (touched_minor) {
   cat(sprintf("Refreshing per-minor index %s\n", minor))
+  clean_index_workdir()
   bincraft::upload_package_index(
     codename = codename,
     r_minor = minor,