fix(audit): replace arch subsection in place instead of appending duplicates

The weekly audit matched the existing "### <arch>" issue subsection by its
bare header ("### arm64") while writing headers with a
" (N missing, M to rebuild)" suffix. The equality test never matched, so every
run appended a fresh block instead of replacing the old one. Issue bodies
accumulated dozens of stale subsections (alpine-323 had 38 where 2 are
expected), and fetch-rebuild-packages-from-issue.R read the *first* block,
feeding the rebuild a months-old list while the genuinely-missing packages were
never rebuilt.

- Match arch subsections by prefix and drop all blocks for the arch before
  writing one fresh block, so accumulation self-heals each run.
- Add local/dedupe-audit-issue.R to collapse the already-accumulated
  duplicates in the existing issues (keeps the freshest block per arch).
- Make fetch-rebuild-packages-from-issue.R prefer the audit's freshly-written
  RDS, falling back to issue parsing when it is absent.

local/fetch-rebuild-packages-from-issue.R

@@ -4,7 +4,6 @@ forgejo_base <- "https://git.devxy.io/api/v1"
 repo <- "devxy/build-cran-binaries"
 platform <- Sys.getenv("PLATFORM")
 arch <- Sys.getenv("ARCH")
-token <- Sys.getenv("FORGEJO_TOKEN")
 output_file <- Sys.getenv("REBUILD_PKG_LIST", "/tmp/rebuild_pkgs.txt")
 
 if (nchar(platform) == 0) {
@@ -13,6 +12,36 @@ if (nchar(platform) == 0) {
 if (nchar(arch) == 0) {
   stop("ARCH env var is not set")
 }
+
+# Prefer the audit's freshly-written RDS. The audit overwrites it each run
+# (saveRDS), so unlike the Forgejo issue body it is never subject to the
+# duplicate-subsection accumulation bug. Fall back to parsing the issue when the
+# RDS is absent (e.g. a fresh runner with no shared cache).
+rds_file <- file.path(
+  Sys.getenv("REBUILD_PKG_RDS_DIR", "/mnt/cache/packages"),
+  sprintf("weekly_rebuild_%s_%s.rds", platform, arch)
+)
+if (file.exists(rds_file)) {
+  pkgs <- tryCatch(as.character(readRDS(rds_file)), error = function(e) NULL)
+  if (!is.null(pkgs) && length(pkgs) > 0) {
+    cat(sprintf(
+      "Using audit RDS %s: %d rebuildable packages for %s/%s\n",
+      rds_file,
+      length(pkgs),
+      platform,
+      arch
+    ))
+    writeLines(pkgs, output_file)
+    cat(sprintf("Wrote package list to %s\n", output_file))
+    q("no")
+  }
+  cat(sprintf(
+    "RDS %s present but empty/unreadable -- falling back to issue\n",
+    rds_file
+  ))
+}
+
+token <- Sys.getenv("FORGEJO_TOKEN")
 if (nchar(token) == 0) {
   stop("FORGEJO_TOKEN env var is not set")
 }