feat(abi): backfill classifier verdicts for pre-per-minor packages (#199)

## Why

bincraft PR #124 makes the `abi_classification` cache authoritative for the risky-package set, breaking the circularity where a package counted as ABI-risky only once it had already been built per-minor.

On its own that changes nothing for the packages actually at risk. The cache only holds verdicts for packages that passed through the build pipeline after the per-minor scheme existed; everything older has no verdict, and no verdict means the flat binary is carried into every per-minor index. That is exactly how a `base64enc` built under R 4.4.3 reached an R 4.6.1 client:

```
base64enc.so: undefined symbol: SETLENGTH
```

This is the backfill that gives those packages a verdict.

## What it does

`local/backfill-abi-classification.R` enumerates a slot's flat index and runs each compiled package through `bincraft::classify_r_minor_sensitive()`, which looks the verdict up in the cache, and on a miss downloads the CRAN source, classifies it and stores the result.

The verdict is a property of the source, independent of OS, arch and R minor, so **one run populates the cache for every slot**. The arch/codename arguments only choose which flat index to enumerate.

Only `NeedsCompilation=yes` packages are classified: a package with no compiled code has no symbols to bind and cannot fail this way, so proving it by download would be wasted work. On amd64/resolute that is 4585 packages rather than 23218.

Re-running is cheap and resumable: cached verdicts return without touching the network, so a second run costs one query per package and downloads only the remainder.

## Verification

The enumeration was run against the live indexes and matches an independent symbol scan of the same slot exactly:

```
flat binaries: 23218 | due classification: 4585
base64enc included: TRUE
lobstr included:    TRUE
```

4585 is the same population I scanned with `nm -D --undefined-only` when establishing the blast radius, and both packages confirmed to break under 4.6 are in it.

`crow lint` passes.

## Sequencing

Merge after bincraft #124 and after a bincraft release the pipelines pick up, otherwise the verdicts are written but nothing reads them yet. Writing them early is harmless.

Then re-index the slots so the per-minor indexes are rebuilt with the widened risky set. Expect coverage in the per-minor indexes to *drop* slightly as newly-recognised risky packages are dropped rather than served from a mismatched minor; those then need per-minor builds, either through the normal pipeline or the targeted workflow in devxy/build-cran-binaries#198.

Reviewed-on: #199

local/backfill-abi-classification.R

@@ -0,0 +1,129 @@
+### Classify every compiled package in a slot's flat index, into the ABI cache.
+#
+# Usage: Rscript local/backfill-abi-classification.R <arch> <codename> [limit]
+#
+# The per-minor scheme only ever classified packages that passed through the
+# build pipeline after it existed. Everything built before that, and not updated
+# on CRAN since, has no verdict at all -- and bincraft's risky set is what
+# decides whether a flat binary may be carried into a per-minor index. With no
+# verdict the answer defaults to "carry it", which is how a base64enc built
+# under R 4.4.3 reached R 4.6 clients and died at dyn.load() on SETLENGTH.
+#
+# The verdict is a property of the source, so it is independent of OS, arch and
+# R minor: one slot's backfill populates the cache for every slot. The slot
+# argument only selects which flat index to enumerate.
+#
+# Only packages with NeedsCompilation=yes are classified. A package with no
+# compiled code has no symbols to bind and cannot fail this way, so downloading
+# its source to prove that would be wasted work.
+#
+# Resumable: `classify_r_minor_sensitive()` returns cached verdicts without
+# touching the network, so a re-run costs one query per package and only the
+# unclassified remainder is downloaded.
+
+options(error = function() {
+  cat("ERROR:", geterrmessage(), "\n", file = stdout())
+  traceback(2)
+  q(status = 1)
+})
+
+library(bincraft, quietly = TRUE)
+
+args <- commandArgs(trailingOnly = TRUE)
+if (length(args) < 2L) {
+  stop(
+    "usage: backfill-abi-classification.R <arch> <codename> [limit]",
+    call. = FALSE
+  )
+}
+arch <- args[[1L]]
+codename <- args[[2L]]
+limit <- if (length(args) >= 3L) as.integer(args[[3L]]) else NA_integer_
+
+db <- list(
+  metadata_db_type = "postgres",
+  metadata_db_host = "r-binaries.devxy.io",
+  metadata_db_name = "build_metadata",
+  metadata_db_port = 15432L,
+  metadata_db_user = "rpkgs",
+  metadata_db_password = Sys.getenv("PGPASS"),
+  metadata_db_sslmode = "require"
+)
+
+read_index <- function(index_url) {
+  con <- gzcon(url(index_url, open = "rb"))
+  on.exit(close(con), add = TRUE)
+  read.dcf(con, fields = c("Package", "Version", "Built"))
+}
+
+flat <- read_index(sprintf(
+  "https://cran.rpkgs.com/%s/%s/latest/src/contrib/PACKAGES.gz",
+  arch,
+  codename
+))
+# Source fallbacks have no binary to be unsafe, so skip them.
+flat <- flat[!is.na(flat[, "Built"]), , drop = FALSE]
+
+cran <- read.dcf(
+  gzcon(url(
+    "https://cloud.r-project.org/src/contrib/PACKAGES.gz",
+    open = "rb"
+  )),
+  fields = c("Package", "NeedsCompilation")
+)
+compiled <- cran[
+  !is.na(cran[, "NeedsCompilation"]) & cran[, "NeedsCompilation"] == "yes",
+  "Package"
+]
+
+todo <- flat[flat[, "Package"] %in% compiled, , drop = FALSE]
+cat(sprintf(
+  "%s/%s: %d binaries in the flat index, %d compiled and due classification\n",
+  arch,
+  codename,
+  nrow(flat),
+  nrow(todo)
+))
+if (!is.na(limit) && limit > 0L && limit < nrow(todo)) {
+  todo <- todo[seq_len(limit), , drop = FALSE]
+  cat(sprintf("Limited to the first %d\n", limit))
+}
+
+sensitive <- 0L
+failed <- 0L
+for (i in seq_len(nrow(todo))) {
+  pkg <- todo[i, "Package"]
+  ver <- todo[i, "Version"]
+  verdict <- tryCatch(
+    do.call(
+      bincraft::classify_r_minor_sensitive,
+      c(list(package_name = pkg, tag = ver), db)
+    ),
+    error = function(e) {
+      cat(sprintf("  %s %s: %s\n", pkg, ver, conditionMessage(e)))
+      NA
+    }
+  )
+  if (is.na(verdict)) {
+    failed <- failed + 1L
+  } else if (isTRUE(verdict)) {
+    sensitive <- sensitive + 1L
+  }
+  if (i %% 250L == 0L) {
+    cat(sprintf(
+      "  classified %d/%d (%d r-minor-sensitive, %d failed)\n",
+      i,
+      nrow(todo),
+      sensitive,
+      failed
+    ))
+    utils::flush.console()
+  }
+}
+
+cat(sprintf(
+  "Done: %d classified, %d r-minor-sensitive, %d failed\n",
+  nrow(todo),
+  sensitive,
+  failed
+))