fix(audit): replace arch subsection in place instead of appending duplicates (#138)

## Problem

A fresh `weekly-audit-missing` run followed by `weekly-rebuild-missing` reported that almost every package "already exists in the remote bucket", even though the audit had just flagged them as missing.

Root cause: the audit's Forgejo-issue update matched the existing `### <arch>` subsection by its **bare** header (`### arm64`) while writing headers with a ` (N missing, M to rebuild)` suffix.
The equality test never matched, so every run **appended** a new block instead of replacing the old one.
Issue #63 had accumulated 38 arch subsections under `## alpine-323` where 2 are expected (75 total across the alpine platforms; body ~77k lines).

`fetch-rebuild-packages-from-issue.R` reads the **first** matching block, which was the oldest snapshot.
So the rebuild kept re-checking a months-old list (180 packages, mostly already built), while the genuinely-missing packages, ~1921 for alpine-323/arm64 in the freshest block, were never fed to the rebuild and the backlog grew silently.

## Changes

- **`local/weekly-missing-binaries-audit.R`**: match arch subsections by prefix (`^### <arch>( |$)`) and remove **all** blocks for that arch before writing one fresh block. Accumulation now self-heals on every run.
- **`local/dedupe-audit-issue.R`** (new): one-off cleanup that collapses each `## platform` section to the freshest block per arch across the three OS-family issues. Supports `DRY_RUN=1`.
- **`local/fetch-rebuild-packages-from-issue.R`**: prefer the audit's freshly-written RDS (overwritten each run, immune to issue-body drift), falling back to issue parsing when absent.

## Validation

Simulated the dedupe logic against the live #63 body: **75 → 8** arch subsections, body 77k → 28k lines, and the kept alpine-323/arm64 block correctly resolves to `GARCH.X (3.0)` (the stale first block held `2.0`).

## Follow-ups (not in this PR)

- `alpine-321` is audited but has no row in the rebuild matrix (7,230 missing, never rebuilt).
- An `alpine-324` section exists in the issue but is in neither matrix.

Reviewed-on: #138

local/weekly-missing-binaries-audit.R

@@ -328,7 +328,6 @@ if (nchar(forgejo_token) == 0) {
     }
 
     plat_header <- sprintf("## %s", platform)
-    arch_header <- sprintf("### %s", arch)
 
     plat_idx <- which(lines == plat_header)
 
@@ -359,31 +358,40 @@ if (nchar(forgejo_token) == 0) {
       }
 
       plat_lines <- lines[seq(pi, plat_end)]
-      arch_local_idx <- which(plat_lines == arch_header)
 
-      if (length(arch_local_idx) == 0) {
-        # Append arch subsection at end of platform block
-        lines <- c(
-          lines[seq_len(plat_end)],
-          "",
-          arch_lines,
-          lines[seq(plat_end + 1, length(lines))]
-        )
+      # Arch subsection headers within the platform block (### arm64 / ### amd64).
+      # Match by prefix: headers carry a " (N missing, M to rebuild)" suffix, so
+      # exact-equality matching never found the existing block and silently
+      # appended a duplicate on every run. Remove *all* blocks for this arch
+      # (collapsing any previously accumulated duplicates), then write one fresh
+      # block, so the issue holds a single current subsection per arch.
+      sub_hdr <- which(grepl("^### ", plat_lines))
+      arch_re <- sprintf("^### %s( |$)", arch)
+
+      if (length(sub_hdr) == 0) {
+        # No arch subsections yet -- append after the platform header/preamble.
+        new_plat_lines <- c(plat_lines, "", arch_lines)
       } else {
-        ai <- pi + arch_local_idx[1] - 1 # absolute line index
-
-        # End of arch subsection
-        next_arch <- which(
-          grepl("^### |^## |^---", lines) & seq_along(lines) > ai
-        )
-        arch_end <- if (length(next_arch) > 0) next_arch[1] - 1 else plat_end
-
-        lines <- c(
-          lines[seq_len(ai - 1)],
-          arch_lines,
-          lines[seq(arch_end + 1, length(lines))]
-        )
+        preamble <- plat_lines[seq_len(sub_hdr[1] - 1)]
+        # Each subsection runs from its ### header to the line before the next
+        # ### header (#### known-failures stays inside its own block).
+        sub_end <- c(sub_hdr[-1] - 1, length(plat_lines))
+        kept <- character(0)
+        for (k in seq_along(sub_hdr)) {
+          block <- plat_lines[seq(sub_hdr[k], sub_end[k])]
+          if (!grepl(arch_re, block[1])) {
+            kept <- c(kept, block)
+          }
+        }
+        new_plat_lines <- c(preamble, kept, "", arch_lines)
       }
+
+      tail_lines <- if (plat_end < length(lines)) {
+        lines[seq(plat_end + 1, length(lines))]
+      } else {
+        character(0)
+      }
+      lines <- c(lines[seq_len(pi - 1)], new_plat_lines, tail_lines)
     }
 
     # Rebuild excluded footer