ci(crow): add weekly patch-proposal + feedback-loop pipeline (#118)

Adds the scheduled pipeline for the failure-triage proposer/tracker landed in #117 (issue #115, steps 3 + 4).

## `.crow/weekly-patch-proposals.yaml`

A single (non-matrix) job -- the classifier groups over all of `single_builds`, so unlike the per-platform `weekly-audit-missing` it runs once globally. Weekly it:

1. `propose-patches.R --open-issue` -- posts/updates a Forgejo tracking issue with the auto-proposable registry entries (human reviews, trial-builds, opens the PR; nothing merges).
2. `proposal-tracking.R` -- logs the feedback-loop metrics (signature hit rate, proposed-vs-merged, retirement candidates).

Low blast radius: clones read-only (`REPO_RO_TOKEN`); the only write is the tracking issue via `FORGEJO_TOKEN`. It builds nothing (no B2 keys, no bincraft).

Triggers: `cron: weekly-patch-proposals` (register the cron in the crow UI) or manual with `task=weekly-patch-proposals`, matching the `archive-missed-packages` convention. Documented under "Scheduled run" in `local/patches/README.md`.

`yamllint` and the other pre-commit hooks pass.

Reviewed-on: #118

.crow/weekly-patch-proposals.yaml

@@ -0,0 +1,57 @@
+# Weekly failure-triage proposals (issue #115, steps 3 + 4).
+# Classifies the recorded `single_builds` failures and:
+#   1. posts/updates a Forgejo tracking issue with the auto-proposable registry
+#      entries (human reviews, trial-builds, and opens the PR -- nothing merges), and
+#   2. prints the feedback-loop metrics (signature hit rate, proposed-vs-merged,
+#      retirement candidates) to the run log.
+# Global across platforms (the classifier groups over all of single_builds), so
+# a single job -- no matrix. Clones read-only; the only write is the Forgejo
+# issue via FORGEJO_TOKEN.
+#
+# Register the cron in the crow UI as `weekly-patch-proposals`, or run manually:
+#   woodpecker-cli pipeline create --var task=weekly-patch-proposals --branch=main 7
+when:
+  - event: manual
+    evaluate: 'task == "weekly-patch-proposals"'
+  - event: cron
+    cron: weekly-patch-proposals
+
+skip_clone: true
+
+labels:
+  group: rpkgs-amd64
+
+steps:
+  - name: 'Propose registry patches + track feedback loop'
+    image: reg.devxy.io/rpkgs/build-env-alpine:3.24
+    pull: true
+    environment:
+      PGPASS:
+        from_secret: PGPASS
+      REPO_RO_TOKEN:
+        from_secret: REPO_RO_TOKEN
+      FORGEJO_TOKEN:
+        from_secret: FORGEJO_TOKEN
+      R_VERSION: 4.5.3
+      R_LIBS_USER: /mnt/cache/R-pkgs
+    commands:
+      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
+      - mkdir -p /mnt/cache/R-pkgs
+      - rm -rf /mnt/cache/R-pkgs/00LOCK-*
+      - /opt/R/$R_VERSION/bin/R -q -e 'pak::pak(c("httr2", "jsonlite"))'
+      - /opt/R/$R_VERSION/bin/Rscript local/propose-patches.R --open-issue
+      - /opt/R/$R_VERSION/bin/Rscript local/proposal-tracking.R
+    backend_options:
+      kubernetes:
+        resources:
+          requests:
+            memory: 1Gi
+            cpu: 2000m
+          limits:
+            memory: 2Gi
+            cpu: 2000m
+        tolerations:
+          - key: 'CI'
+            operator: 'Equal'
+            value: 'true'
+            effect: 'NoSchedule'

local/patches/README.md

@@ -93,3 +93,8 @@ PGPASS=... Rscript local/proposal-tracking.R --json metrics.json
 ```
 
 The pure metric/ledger helpers live in `local/proposal-tracking-lib.R` and are covered by `local/tests/test-proposal-tracking-lib.R`.
+
+### Scheduled run
+
+`.crow/weekly-patch-proposals.yaml` runs both steps weekly (register the `weekly-patch-proposals` cron in the crow UI): it posts/updates a Forgejo tracking issue with the auto-proposable entries and logs the feedback-loop metrics.
+It clones read-only; the only write is the tracking issue.