fix(ci): bound pkgcache _metadata growth to stop macmini disk-fill (#110)

## Problem

The arm64 `build-all` pipeline fills the macmini (gaia) host disk despite an 8h prune.
Root cause is not images or job volumes: it is the persistent dep-cache volume, specifically `pkgcache/R/pkgcache/_metadata`, which grew to ~165 GB.
`{pkgcache}` mints a new content hash for the "patched" binaries repo on every PACKAGES change, so each per-package build writes a fresh ~70 MB `pkgs-<hash>.rds` (+ `patched-<hash>/`) that is never evicted (2407 snapshots observed).
When the disk hits 100% OrbStack stops and the on-host prune can no longer connect to the daemon, so it never self-heals.

## Change (Workstream A of the disk-fill fix)

- Add `trim_pkgcache_metadata()` to `local/r-minor-helpers.R`: keeps the newest `keep` (default 20) `patched-*`/`pkgs-*.rds` entries under `_metadata`, deleting only entries older than `min_age_secs` (default 600s) so it never races the up-to-4 concurrent split-jobs sharing the volume.
Preserves `pkg/` downloads and the stable CRAN/BioC/INLA repo dirs.
No-op when `R_PKG_CACHE_DIR` is empty (amd64) or `_metadata` is absent (first run).
- Call it every 25 packages inside the build loop in `local/build-all.R`.
- Add a defensive start-of-run cleanup of `_metadata/patched-*` + `pkgs-*.rds` to the two workflows that mount the persistent volume (`build-all-versions.yaml`, `build-all-versions-install-deps.yaml`).

Only these paths are touched; `process-updates.yaml`/`weekly-rebuild-missing.yaml` (no persistent volume) are unchanged.

Follow-ups (separate workstreams): on-host self-healing prune watcher + OrbStack disk cap (ansible), and Prometheus/Grafana alerting (k8s-talos).
Upstream: bincraft patched-repo hash churn is the true source fix.

New unit tests (6) for the helper; full suite 24/24 green.

Reviewed-on: #110

.crow/build-all-versions-install-deps.yaml

@@ -4,7 +4,7 @@
 # they are merged with build-all-versions' identical declarations.
 variables:
   target_arch:
-    description: "Architecture to build."
+    description: 'Architecture to build.'
     options:
       - amd64
       - arm64
@@ -27,7 +27,7 @@ variables:
       - "noble"
     default: "3.24"
   R_VERSION:
-    description: "Primary R version under /opt/R."
+    description: 'Primary R version under /opt/R.'
     options:
       - 4.5.3
       - 4.4.3
@@ -74,6 +74,10 @@ steps:
     commands:
       # one-time full wipe to fix corrupted .so files from previous failed builds
       # - rm -rf /mnt/cache/R-pkgs
+      # Clear churny pkgcache metadata left by a prior crashed run (the "patched"
+      # repo mints a new hash per PACKAGES change -> unbounded pkgs-*.rds/patched-*).
+      # Keep pkg/ downloads and the stable CRAN/BioC/INLA repo dirs.
+      - rm -rf /mnt/cache/pkgcache/R/pkgcache/_metadata/patched-* /mnt/cache/pkgcache/R/pkgcache/_metadata/pkgs-*.rds || true
       - mkdir -p /mnt/cache/pkgcache /mnt/cache/R-pkgs /mnt/cache/ccache /mnt/cache/packages
       - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
       # Pin the same bincraft version the build steps use, so the precomputed

.crow/build-all-versions.yaml

@@ -5,7 +5,7 @@
 # Skip list lives in local/excluded-packages.json (read by local/build-all.R).
 variables:
   target_arch:
-    description: "Architecture to build."
+    description: 'Architecture to build.'
     options:
       - amd64
       - arm64
@@ -31,7 +31,7 @@ variables:
       - "resolute"
     default: "3.24"
   R_VERSION:
-    description: "Primary R version under /opt/R."
+    description: 'Primary R version under /opt/R.'
     options:
       - 4.5.3
       - 4.4.3
@@ -116,6 +116,11 @@ steps:
       - ${ARCH}-binaries-r-dep-cache-${OS}-${OS_VERSION//./}:/mnt/cache
     commands:
       - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
+      # Clear churny pkgcache metadata left by a prior crashed run (the "patched"
+      # repo mints a new hash per PACKAGES change -> unbounded pkgs-*.rds/patched-*).
+      # Keep pkg/ downloads and the stable CRAN/BioC/INLA repo dirs. Within-run
+      # growth is bounded separately by trim_pkgcache_metadata() in build-all.R.
+      - rm -rf /mnt/cache/pkgcache/R/pkgcache/_metadata/patched-* /mnt/cache/pkgcache/R/pkgcache/_metadata/pkgs-*.rds || true
       - mkdir -p /mnt/cache/pkgcache /mnt/cache/R-pkgs /mnt/cache/ccache /mnt/cache/packages
       # The primary pass must not rely on build-all-versions-install-deps having
       # run on *this* agent: depends_on only orders the steps, but the cache