fix(ci): pass the metadata DB to per-minor reindexes and fail on errors

- Pass `metadata_db_*` explicitly to every per-minor `upload_package_index()` call, so bincraft can drop its implicit production defaults (rpkgs/bincraft#211).
- Replace `|| true` in the per-minor reindex loops with a failure list, so every minor is still attempted but a failed reindex fails the step.
- Give the "Upload package indexes" step of build-all-versions the `PGPASS` secret, without which its per-minor reindexes always aborted.
- Run the CDN purge in process-updates and prune-stale-flat-binaries even when a reindex failed, as reindex.yaml already does.
- Fail local/repair-built-stamp.R when a per-minor reindex fails instead of only printing the error.

local/repair-built-stamp.R

@@ -152,18 +152,44 @@ bincraft::upload_package_index(
   s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"),
   s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY")
 )
+# A per-minor index reads the ABI classifier cache and the flat-object safety
+# table from the build database. A failed minor does not stop the others, but
+# it does fail the run once they are done.
+failed_minors <- character(0L)
 for (minor in r_minors) {
-  try(
-    bincraft::upload_package_index(
-      codename = codename,
-      r_minor = minor,
-      s3_endpoint = endpoint,
-      s3_region = region,
-      s3_bucket = bucket,
-      s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"),
-      s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY")
-    ),
-    silent = FALSE
+  ok <- tryCatch(
+    {
+      bincraft::upload_package_index(
+        codename = codename,
+        r_minor = minor,
+        s3_endpoint = endpoint,
+        s3_region = region,
+        s3_bucket = bucket,
+        s3_access_key_id = Sys.getenv("B2_S3_ACCESS_KEY"),
+        s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY"),
+        metadata_db_host = "r-binaries.devxy.io",
+        metadata_db_name = "build_metadata",
+        metadata_db_port = 15432L,
+        metadata_db_user = "rpkgs",
+        metadata_db_password = Sys.getenv("PGPASS"),
+        metadata_db_sslmode = "require"
+      )
+      TRUE
+    },
+    error = function(e) {
+      message(sprintf("Re-indexing %s failed: %s", minor, conditionMessage(e)))
+      FALSE
+    }
+  )
+  if (!ok) {
+    failed_minors <- c(failed_minors, minor)
+  }
+}
+if (length(failed_minors) > 0L) {
+  stop(
+    "Could not republish the per-minor index for: ",
+    paste(failed_minors, collapse = ", "),
+    call. = FALSE
   )
 }