fix(ci): bound pkgcache _metadata growth to stop macmini disk-fill (#110)

## Problem

The arm64 `build-all` pipeline fills the macmini (gaia) host disk despite an 8h prune.
Root cause is not images or job volumes: it is the persistent dep-cache volume, specifically `pkgcache/R/pkgcache/_metadata`, which grew to ~165 GB.
`{pkgcache}` mints a new content hash for the "patched" binaries repo on every PACKAGES change, so each per-package build writes a fresh ~70 MB `pkgs-<hash>.rds` (+ `patched-<hash>/`) that is never evicted (2407 snapshots observed).
When the disk hits 100% OrbStack stops and the on-host prune can no longer connect to the daemon, so it never self-heals.

## Change (Workstream A of the disk-fill fix)

- Add `trim_pkgcache_metadata()` to `local/r-minor-helpers.R`: keeps the newest `keep` (default 20) `patched-*`/`pkgs-*.rds` entries under `_metadata`, deleting only entries older than `min_age_secs` (default 600s) so it never races the up-to-4 concurrent split-jobs sharing the volume.
Preserves `pkg/` downloads and the stable CRAN/BioC/INLA repo dirs.
No-op when `R_PKG_CACHE_DIR` is empty (amd64) or `_metadata` is absent (first run).
- Call it every 25 packages inside the build loop in `local/build-all.R`.
- Add a defensive start-of-run cleanup of `_metadata/patched-*` + `pkgs-*.rds` to the two workflows that mount the persistent volume (`build-all-versions.yaml`, `build-all-versions-install-deps.yaml`).

Only these paths are touched; `process-updates.yaml`/`weekly-rebuild-missing.yaml` (no persistent volume) are unchanged.

Follow-ups (separate workstreams): on-host self-healing prune watcher + OrbStack disk cap (ansible), and Prometheus/Grafana alerting (k8s-talos).
Upstream: bincraft patched-repo hash churn is the true source fix.

New unit tests (6) for the helper; full suite 24/24 green.

Reviewed-on: #110

local/r-minor-helpers.R

@@ -31,3 +31,42 @@ parse_build_args <- function(args) {
     ncpus = as.integer(pos[3L])
   )
 }
+
+# Bound the {pkgcache} metadata dir, which otherwise grows without limit: the
+# "patched" repo mints a new content hash on every PACKAGES change, so each build
+# writes a fresh ~70 MB _metadata/pkgs-<hash>.rds (+ patched-<hash>/) that is
+# never reused. Keep the `keep` newest entries by mtime; only remove entries
+# older than `min_age_secs`, so a concurrent split-job's in-flight files are
+# never deleted (each build uses a unique hash, so aged entries are
+# unreferenced). Stable repo dirs (CRAN-*, BioC*, INLA-*) and pkg/ downloads are
+# not matched and thus preserved. Returns the number of entries removed.
+trim_pkgcache_metadata <- function(cache_dir = Sys.getenv("R_PKG_CACHE_DIR"),
+                                   keep = 20L,
+                                   min_age_secs = 600) {
+  meta <- file.path(cache_dir, "R", "pkgcache", "_metadata")
+  if (!nzchar(cache_dir) || !dir.exists(meta)) {
+    return(0L)
+  }
+  entries <- c(
+    Sys.glob(file.path(meta, "patched-*")),
+    Sys.glob(file.path(meta, "pkgs-*.rds"))
+  )
+  if (length(entries) == 0L) {
+    return(0L)
+  }
+  info <- file.info(entries)
+  order_new_first <- order(info$mtime, decreasing = TRUE)
+  ranked <- entries[order_new_first]
+  ranked_mtime <- info$mtime[order_new_first]
+  if (length(ranked) <= keep) {
+    return(0L)
+  }
+  candidates <- ranked[(keep + 1L):length(ranked)]
+  candidate_age <- as.numeric(Sys.time()) - as.numeric(ranked_mtime[(keep + 1L):length(ranked)])
+  removable <- candidates[candidate_age >= min_age_secs]
+  if (length(removable) == 0L) {
+    return(0L)
+  }
+  unlink(removable, recursive = TRUE, force = TRUE)
+  length(removable)
+}