fix(audit): replace arch subsection in place instead of appending duplicates (#138)

## Problem

A fresh `weekly-audit-missing` run followed by `weekly-rebuild-missing` reported that almost every package "already exists in the remote bucket", even though the audit had just flagged them as missing.

Root cause: the audit's Forgejo-issue update matched the existing `### <arch>` subsection by its **bare** header (`### arm64`) while writing headers with a ` (N missing, M to rebuild)` suffix.
The equality test never matched, so every run **appended** a new block instead of replacing the old one.
Issue #63 had accumulated 38 arch subsections under `## alpine-323` where 2 are expected (75 total across the alpine platforms; body ~77k lines).

`fetch-rebuild-packages-from-issue.R` reads the **first** matching block, which was the oldest snapshot.
So the rebuild kept re-checking a months-old list (180 packages, mostly already built), while the genuinely-missing packages, ~1921 for alpine-323/arm64 in the freshest block, were never fed to the rebuild and the backlog grew silently.

## Changes

- **`local/weekly-missing-binaries-audit.R`**: match arch subsections by prefix (`^### <arch>( |$)`) and remove **all** blocks for that arch before writing one fresh block. Accumulation now self-heals on every run.
- **`local/dedupe-audit-issue.R`** (new): one-off cleanup that collapses each `## platform` section to the freshest block per arch across the three OS-family issues. Supports `DRY_RUN=1`.
- **`local/fetch-rebuild-packages-from-issue.R`**: prefer the audit's freshly-written RDS (overwritten each run, immune to issue-body drift), falling back to issue parsing when absent.

## Validation

Simulated the dedupe logic against the live #63 body: **75 → 8** arch subsections, body 77k → 28k lines, and the kept alpine-323/arm64 block correctly resolves to `GARCH.X (3.0)` (the stale first block held `2.0`).

## Follow-ups (not in this PR)

- `alpine-321` is audited but has no row in the rebuild matrix (7,230 missing, never rebuilt).
- An `alpine-324` section exists in the issue but is in neither matrix.

Reviewed-on: #138

local/fetch-rebuild-packages-from-issue.R

@@ -4,7 +4,6 @@ forgejo_base <- "https://git.devxy.io/api/v1"
 repo <- "devxy/build-cran-binaries"
 platform <- Sys.getenv("PLATFORM")
 arch <- Sys.getenv("ARCH")
-token <- Sys.getenv("FORGEJO_TOKEN")
 output_file <- Sys.getenv("REBUILD_PKG_LIST", "/tmp/rebuild_pkgs.txt")
 
 if (nchar(platform) == 0) {
@@ -13,6 +12,36 @@ if (nchar(platform) == 0) {
 if (nchar(arch) == 0) {
   stop("ARCH env var is not set")
 }
+
+# Prefer the audit's freshly-written RDS. The audit overwrites it each run
+# (saveRDS), so unlike the Forgejo issue body it is never subject to the
+# duplicate-subsection accumulation bug. Fall back to parsing the issue when the
+# RDS is absent (e.g. a fresh runner with no shared cache).
+rds_file <- file.path(
+  Sys.getenv("REBUILD_PKG_RDS_DIR", "/mnt/cache/packages"),
+  sprintf("weekly_rebuild_%s_%s.rds", platform, arch)
+)
+if (file.exists(rds_file)) {
+  pkgs <- tryCatch(as.character(readRDS(rds_file)), error = function(e) NULL)
+  if (!is.null(pkgs) && length(pkgs) > 0) {
+    cat(sprintf(
+      "Using audit RDS %s: %d rebuildable packages for %s/%s\n",
+      rds_file,
+      length(pkgs),
+      platform,
+      arch
+    ))
+    writeLines(pkgs, output_file)
+    cat(sprintf("Wrote package list to %s\n", output_file))
+    q("no")
+  }
+  cat(sprintf(
+    "RDS %s present but empty/unreadable -- falling back to issue\n",
+    rds_file
+  ))
+}
+
+token <- Sys.getenv("FORGEJO_TOKEN")
 if (nchar(token) == 0) {
   stop("FORGEJO_TOKEN env var is not set")
 }