feat: R-minor-sensitive binary builds (full + iterative) (#84)

## Summary

Builds R-minor-sensitive CRAN packages once per installed R minor version (into per-minor S3 slots `…/contrib/<x.y>/`) and everything else once into the generic slot, driven by bincraft 4.2.0's ABI classifier. Both the full and iterative pipelines are covered.

## What's in here

**Detection / precompute**

- `local/r-minor-helpers.R` — pure `classify_from_metadata()` (NeedsCompilation / risky `LinkingTo`) + `parse_build_args()`, with unit tests.
- `local/packages-to-build.R` — adds a per-package `r_minor_sensitive` flag: cheap CRAN-metadata rules first, source download + `bincraft::needs_per_minor_recompile()` only for the ambiguous compiled subset (fail-safe to sensitive). Classified once per package, applied to all versions.

**Full build**

- `local/build-all.R` — passes the per-row `is_r_minor_sensitive` flag; new `--sensitive-only` mode builds just the risky subset.
- `.crow/build-all-versions-{amd64,arm64}.yaml` — install-deps persists the sensitive subset; build step runs a sensitive-only pass under each non-primary `/opt/R/*` minor; new step uploads the generic index plus a per-minor index for each minor.

**Iterative build**

- All 14 `.crow/process-updates-*.yaml` — primary pass uses `r_minor_detection = 'classifier'`; a sensitive-only multi-R pass builds risky updates under each other minor; per-minor index upload added.

**Tooling / housekeeping**

- Pins bincraft `v4.1.1` → `v4.2.0` across all workflows; removes the superseded standalone `build-r-minor-sensitive-packages.yaml`.
- Adds prek/pre-commit hooks (prettier, markdownlint, editorconfig-checker, yamllint, air) and applies them repo-wide; excludes the verbatim GPL `LICENSE.md` and auxiliary shell scripts.
- Design + implementation docs under `docs/superpowers/`.

## Requires before merge

- A `v4.2.0` git tag must be pushed on the bincraft repo (codefloe.com/rpkgs/bincraft) — the workflow install steps pin `@v4.2.0`. The full-build install-deps clones `main`, so it is unaffected.

Reviewed-on: #84

local/archive-missed-pkgs.R

@@ -11,16 +11,34 @@ s3fs::s3_file_system(
 arch = "arm64"
 os = "alpine321"
 
-files <- s3fs::s3_dir_ls(sprintf("devxy-r-package-binaries-hel1/%s/%s/latest/src/contrib", arch, os))
+files <- s3fs::s3_dir_ls(sprintf(
+  "devxy-r-package-binaries-hel1/%s/%s/latest/src/contrib",
+  arch,
+  os
+))
 length(unique(sapply(strsplit(basename(files), "_"), function(x) x[1])))
-non_archived = unique(sapply(strsplit(basename(files), "_"), function(x) x[1])[duplicated(sapply(strsplit(basename(files), "_"), function(x) x[1]))])
+non_archived = unique(sapply(strsplit(basename(files), "_"), function(x) {
+  x[1]
+})[duplicated(sapply(strsplit(basename(files), "_"), function(x) x[1]))])
 # RInno is not built because it only exists for Windows
 non_archived = setdiff(non_archived, "RInno")
 # future::plan("sequential", workers = 8)
 future::plan("sequential", workers = 1)
 # future.apply::future_lapply(non_archived, function(x) archive_package(x, codename = os, arch = arch))
-lapply(non_archived, function(x) archive_package(x, codename = os, arch = arch, s3_region = "hel1", s3_endpoint = "https://hel1.your-objectstorage.com", s3_bucket = "devxy-r-package-binaries-hel1", s3_access_key_id = Sys.getenv("HETZNER_S3_ACCESS_KEY_K3S", s3_secret_access_key = Sys.getenv("HETZNER_S3_SECRET_KEY_K3S"))))
+lapply(non_archived, function(x) {
+  archive_package(
+    x,
+    codename = os,
+    arch = arch,
+    s3_region = "hel1",
+    s3_endpoint = "https://hel1.your-objectstorage.com",
+    s3_bucket = "devxy-r-package-binaries-hel1",
+    s3_access_key_id = Sys.getenv(
+      "HETZNER_S3_ACCESS_KEY_K3S",
+      s3_secret_access_key = Sys.getenv("HETZNER_S3_SECRET_KEY_K3S")
+    )
+  )
+})
 # archive_package()
 
-
 # grep("duckdb_", files, value = T)