feat: R-minor-sensitive binary builds (full + iterative) (#84)

## Summary

Builds R-minor-sensitive CRAN packages once per installed R minor version (into per-minor S3 slots `…/contrib/<x.y>/`) and everything else once into the generic slot, driven by bincraft 4.2.0's ABI classifier. Both the full and iterative pipelines are covered.

## What's in here

**Detection / precompute**

- `local/r-minor-helpers.R` — pure `classify_from_metadata()` (NeedsCompilation / risky `LinkingTo`) + `parse_build_args()`, with unit tests.
- `local/packages-to-build.R` — adds a per-package `r_minor_sensitive` flag: cheap CRAN-metadata rules first, source download + `bincraft::needs_per_minor_recompile()` only for the ambiguous compiled subset (fail-safe to sensitive). Classified once per package, applied to all versions.

**Full build**

- `local/build-all.R` — passes the per-row `is_r_minor_sensitive` flag; new `--sensitive-only` mode builds just the risky subset.
- `.crow/build-all-versions-{amd64,arm64}.yaml` — install-deps persists the sensitive subset; build step runs a sensitive-only pass under each non-primary `/opt/R/*` minor; new step uploads the generic index plus a per-minor index for each minor.

**Iterative build**

- All 14 `.crow/process-updates-*.yaml` — primary pass uses `r_minor_detection = 'classifier'`; a sensitive-only multi-R pass builds risky updates under each other minor; per-minor index upload added.

**Tooling / housekeeping**

- Pins bincraft `v4.1.1` → `v4.2.0` across all workflows; removes the superseded standalone `build-r-minor-sensitive-packages.yaml`.
- Adds prek/pre-commit hooks (prettier, markdownlint, editorconfig-checker, yamllint, air) and applies them repo-wide; excludes the verbatim GPL `LICENSE.md` and auxiliary shell scripts.
- Design + implementation docs under `docs/superpowers/`.

## Requires before merge

- A `v4.2.0` git tag must be pushed on the bincraft repo (codefloe.com/rpkgs/bincraft) — the workflow install steps pin `@v4.2.0`. The full-build install-deps clones `main`, so it is unaffected.

Reviewed-on: #84

local/r-minor-helpers.R

@@ -0,0 +1,33 @@
+# Metadata-only ABI triage so the full build avoids downloading every source.
+# Mirrors bincraft::abi_classify rules 1-2; "ambiguous" packages still need a
+# source grep via bincraft::needs_per_minor_recompile().
+
+classify_from_metadata <- function(needs_compilation, linking_to, risky_deps) {
+  nc <- if (length(needs_compilation) == 0L || is.na(needs_compilation)) {
+    ""
+  } else {
+    tolower(trimws(needs_compilation))
+  }
+  if (!identical(nc, "yes")) {
+    return("not-sensitive")
+  }
+  lt <- if (length(linking_to) == 0L || is.na(linking_to)) "" else linking_to
+  linked <- trimws(unlist(strsplit(lt, "[,\n]")))
+  linked <- sub("\\s*\\(.*\\)$", "", linked) # strip "(>= x)" constraints
+  linked <- linked[nzchar(linked)]
+  if (any(linked %in% risky_deps)) {
+    return("sensitive")
+  }
+  "ambiguous"
+}
+
+parse_build_args <- function(args) {
+  sensitive_only <- "--sensitive-only" %in% args
+  pos <- args[!startsWith(args, "--")]
+  list(
+    sensitive_only = sensitive_only,
+    split_into = as.integer(pos[1L]),
+    split_index = as.integer(pos[2L]),
+    ncpus = as.integer(pos[3L])
+  )
+}