feat(ci): verify what clients actually receive from every published slot

Add a manual pipeline that installs a fixed package set from a slot under
every R minor its image carries, through each URL form the website documents,
and checks that each package loads.

The ABI bookkeeping so far reasons about the binaries: `abi_flat_safety`
records what an object's symbols say, and the index writer acts on that. None
of it proves what a client receives once the CDN rewrite, the per-minor
indexes and the `Path:` field have had their say. This closes that gap, and
runs on the build agents so arm64 is covered on real hardware rather than
skipped.

- `arch` and `generic` are contractual and fail the run.
- `flat` measures a client that hides its R minor; it is reported, never fatal.
- CRAN is deliberately absent from `repos`, so a package missing from our
  index fails loudly instead of being compiled from source behind our backs.

.crow/verify-repo-routing.yaml

@@ -0,0 +1,156 @@
+# Install a fixed set of packages from a published slot under every R minor the
+# image carries, through each URL form the website tells people to configure,
+# and check that each one loads.
+#
+# This is the end-to-end counterpart to the ABI bookkeeping: `abi_flat_safety`
+# records what the binaries say about themselves, this proves what a client
+# actually receives once the CDN, the per-minor indexes and the `Path:` field
+# have had their say. It runs on the build agents rather than a workstation so
+# arm64 is covered on real hardware.
+#
+#   crow pipeline create devxy/build-cran-binaries --var verify_routing=all
+
+variables:
+  # A manual pipeline creation instantiates every file in .crow/, so the default
+  # must match no matrix row.
+  verify_routing:
+    description: "Verify target: a specific <os>-<arch>, 'all' for every slot, or 'none'."
+    options:
+      - none
+      - all
+      - alpine-322-amd64
+      - alpine-322-arm64
+      - alpine-323-amd64
+      - alpine-323-arm64
+      - alpine-324-amd64
+      - alpine-324-arm64
+      - redhat-8-amd64
+      - redhat-8-arm64
+      - redhat-9-amd64
+      - redhat-9-arm64
+      - redhat-10-amd64
+      - redhat-10-arm64
+      - ubuntu-2204-amd64
+      - ubuntu-2204-arm64
+      - ubuntu-2404-amd64
+      - ubuntu-2404-arm64
+      - ubuntu-2604-amd64
+      - ubuntu-2604-arm64
+    default: none
+
+when:
+  - event: manual
+    evaluate: 'verify_routing == "all" || verify_routing == "${OS}-${ARCH}"'
+
+skip_clone: true
+
+labels:
+  group: rpkgs-${ARCH}
+
+matrix:
+  include:
+    - OS: alpine-322
+      ARCH: amd64
+      R_VERSION: 4.5.3
+      IMG: alpine:3.22
+    - OS: alpine-322
+      ARCH: arm64
+      R_VERSION: 4.5.3
+      IMG: alpine:3.22
+    - OS: alpine-323
+      ARCH: amd64
+      R_VERSION: 4.5.3
+      IMG: alpine:3.23
+    - OS: alpine-323
+      ARCH: arm64
+      R_VERSION: 4.5.3
+      IMG: alpine:3.23
+    - OS: alpine-324
+      ARCH: amd64
+      R_VERSION: 4.5.3
+      IMG: alpine:3.24
+    - OS: alpine-324
+      ARCH: arm64
+      R_VERSION: 4.5.3
+      IMG: alpine:3.24
+    - OS: redhat-8
+      ARCH: amd64
+      R_VERSION: 4.4.3
+      IMG: redhat:8
+    - OS: redhat-8
+      ARCH: arm64
+      R_VERSION: 4.4.3
+      IMG: redhat:8
+    - OS: redhat-9
+      ARCH: amd64
+      R_VERSION: 4.4.3
+      IMG: redhat:9
+    - OS: redhat-9
+      ARCH: arm64
+      R_VERSION: 4.4.3
+      IMG: redhat:9
+    - OS: redhat-10
+      ARCH: amd64
+      R_VERSION: 4.5.3
+      IMG: redhat:10
+    - OS: redhat-10
+      ARCH: arm64
+      R_VERSION: 4.5.3
+      IMG: redhat:10
+    - OS: ubuntu-2204
+      ARCH: amd64
+      R_VERSION: 4.4.3
+      IMG: ubuntu:jammy
+    - OS: ubuntu-2204
+      ARCH: arm64
+      R_VERSION: 4.4.3
+      IMG: ubuntu:jammy
+    - OS: ubuntu-2404
+      ARCH: amd64
+      R_VERSION: 4.4.3
+      IMG: ubuntu:noble
+    - OS: ubuntu-2404
+      ARCH: arm64
+      R_VERSION: 4.4.3
+      IMG: ubuntu:noble
+    - OS: ubuntu-2604
+      ARCH: amd64
+      R_VERSION: 4.4.3
+      IMG: ubuntu:resolute
+    - OS: ubuntu-2604
+      ARCH: arm64
+      R_VERSION: 4.4.3
+      IMG: ubuntu:resolute
+
+steps:
+  - name: 'Verify routing serves loadable binaries'
+    image: reg.devxy.io/rpkgs/build-env-${IMG}
+    pull: true
+    environment:
+      OTEL_R_TRACES_EXPORTER: none
+      OTEL_R_LOGS_EXPORTER: none
+      OTEL_R_METRICS_EXPORTER: none
+      REPO_RO_TOKEN:
+        from_secret: REPO_RO_TOKEN
+      VERIFY_ARCH: ${ARCH}
+    commands:
+      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
+      - |
+        set -eu
+        CODENAME=$(/opt/R/$R_VERSION/bin/Rscript -e 'cat(bincraft::set_codename(NULL))')
+        rc=0
+        for RBIN in /opt/R/[0-9]*/bin/R; do
+          RV=$(basename "$(dirname "$(dirname "$$RBIN")")")
+          for FORM in arch generic flat; do
+            echo "=== R $$RV via $$FORM ==="
+            "$(dirname "$$RBIN")/Rscript" local/verify-repo-routing.R \
+              "$$VERIFY_ARCH" "$$CODENAME" "$$FORM" || rc=1
+          done
+        done
+        exit $$rc
+    backend_options:
+      docker:
+        resources:
+          requests:
+            memory: 4Gi
+            cpu: 1000m