refactor(build-one): delegate ABI classification to bincraft (#136)

## Motivation

The weekly rebuild hit GitHub's per-user REST rate limit (HTTP 403 "API rate limit exceeded for user ID ..."). The root cause and the shared fix live in bincraft (rpkgs/bincraft#74): version resolution now comes from CRAN metadata instead of the GitHub tags API, and ABI classification is cached.

This PR wires the consumer side.

## Changes

- `local/build-one.R`: `classify()` no longer clones `github.com/cran` and calls `bincraft::needs_per_minor_recompile()` itself. It now delegates to the newly exported `bincraft::classify_r_minor_sensitive()`, passing the metadata-DB parameters so the verdict is fetched from the CRAN source tarball (no GitHub) and cached in the `abi_classification` table. Repeated runs and new-OS full rebuilds reuse the cached verdict.

## Behaviour change

- No functional change to what gets built or where; only how sensitivity is determined (cached, CRAN-tarball-based, no GitHub clone in this path).

## Dependency

- Requires a bincraft release that includes rpkgs/bincraft#74 (exports `classify_r_minor_sensitive()`). Merge and release that first; this branch only takes effect once CI installs the updated bincraft.

Reviewed-on: #136

local/build-one.R

@@ -30,43 +30,21 @@ s3 <- list(
   s3_secret_access_key = Sys.getenv("B2_S3_SECRET_KEY")
 )
 
-# Clone the CRAN source for a version and ask the ABI classifier whether it
-# must be rebuilt per R minor. Fails safe to TRUE so a possibly-fragile binary
-# is never served from the cross-minor generic slot by mistake.
+# Ask bincraft's ABI classifier whether a version must be rebuilt per R minor.
+# The classifier downloads the CRAN source tarball (no GitHub) and caches the
+# verdict in the metadata DB keyed on package+version, so repeated runs and
+# new-OS rebuilds reuse it. Fails safe to TRUE inside bincraft so a
+# possibly-fragile binary is never served from the cross-minor generic slot.
 classify <- function(pkg, ver) {
-  dest <- file.path(tempdir(), sprintf("classify_%s_%s", pkg, ver))
-  on.exit(unlink(dest, recursive = TRUE, force = TRUE), add = TRUE)
-  tryCatch(
-    {
-      message(sprintf(
-        "[classify] cloning %s@%s from github.com/cran ...",
-        pkg,
-        ver
-      ))
-      system2(
-        "git",
-        c(
-          "clone",
-          "--depth",
-          "1",
-          "--branch",
-          ver,
-          sprintf("https://github.com/cran/%s", pkg),
-          dest
-        )
-      )
-      message(sprintf("[classify] running ABI classifier on %s ...", pkg))
-      isTRUE(as.logical(bincraft::needs_per_minor_recompile(dest)))
-    },
-    error = function(e) {
-      message(sprintf(
-        "classify failed for %s %s: %s; treating as r-minor-sensitive",
-        pkg,
-        ver,
-        conditionMessage(e)
-      ))
-      TRUE
-    }
+  bincraft::classify_r_minor_sensitive(
+    pkg,
+    ver,
+    metadata_db_host = "r-binaries.devxy.io",
+    metadata_db_name = "build_metadata",
+    metadata_db_port = 15432,
+    metadata_db_user = "rpkgs",
+    metadata_db_password = Sys.getenv("PGPASS"),
+    metadata_db_sslmode = "require"
   )
 }