fix(audit): replace arch subsection in place instead of appending duplicates

The weekly audit matched the existing "### <arch>" issue subsection by its
bare header ("### arm64") while writing headers with a
" (N missing, M to rebuild)" suffix. The equality test never matched, so every
run appended a fresh block instead of replacing the old one. Issue bodies
accumulated dozens of stale subsections (alpine-323 had 38 where 2 are
expected), and fetch-rebuild-packages-from-issue.R read the *first* block,
feeding the rebuild a months-old list while the genuinely-missing packages were
never rebuilt.

- Match arch subsections by prefix and drop all blocks for the arch before
  writing one fresh block, so accumulation self-heals each run.
- Add local/dedupe-audit-issue.R to collapse the already-accumulated
  duplicates in the existing issues (keeps the freshest block per arch).
- Make fetch-rebuild-packages-from-issue.R prefer the audit's freshly-written
  RDS, falling back to issue parsing when it is absent.

local/weekly-missing-binaries-audit.R

@@ -328,7 +328,6 @@ if (nchar(forgejo_token) == 0) {
     }
 
     plat_header <- sprintf("## %s", platform)
-    arch_header <- sprintf("### %s", arch)
 
     plat_idx <- which(lines == plat_header)
 
@@ -359,31 +358,40 @@ if (nchar(forgejo_token) == 0) {
       }
 
       plat_lines <- lines[seq(pi, plat_end)]
-      arch_local_idx <- which(plat_lines == arch_header)
 
-      if (length(arch_local_idx) == 0) {
-        # Append arch subsection at end of platform block
-        lines <- c(
-          lines[seq_len(plat_end)],
-          "",
-          arch_lines,
-          lines[seq(plat_end + 1, length(lines))]
-        )
+      # Arch subsection headers within the platform block (### arm64 / ### amd64).
+      # Match by prefix: headers carry a " (N missing, M to rebuild)" suffix, so
+      # exact-equality matching never found the existing block and silently
+      # appended a duplicate on every run. Remove *all* blocks for this arch
+      # (collapsing any previously accumulated duplicates), then write one fresh
+      # block, so the issue holds a single current subsection per arch.
+      sub_hdr <- which(grepl("^### ", plat_lines))
+      arch_re <- sprintf("^### %s( |$)", arch)
+
+      if (length(sub_hdr) == 0) {
+        # No arch subsections yet -- append after the platform header/preamble.
+        new_plat_lines <- c(plat_lines, "", arch_lines)
       } else {
-        ai <- pi + arch_local_idx[1] - 1 # absolute line index
-
-        # End of arch subsection
-        next_arch <- which(
-          grepl("^### |^## |^---", lines) & seq_along(lines) > ai
-        )
-        arch_end <- if (length(next_arch) > 0) next_arch[1] - 1 else plat_end
-
-        lines <- c(
-          lines[seq_len(ai - 1)],
-          arch_lines,
-          lines[seq(arch_end + 1, length(lines))]
-        )
+        preamble <- plat_lines[seq_len(sub_hdr[1] - 1)]
+        # Each subsection runs from its ### header to the line before the next
+        # ### header (#### known-failures stays inside its own block).
+        sub_end <- c(sub_hdr[-1] - 1, length(plat_lines))
+        kept <- character(0)
+        for (k in seq_along(sub_hdr)) {
+          block <- plat_lines[seq(sub_hdr[k], sub_end[k])]
+          if (!grepl(arch_re, block[1])) {
+            kept <- c(kept, block)
+          }
+        }
+        new_plat_lines <- c(preamble, kept, "", arch_lines)
       }
+
+      tail_lines <- if (plat_end < length(lines)) {
+        lines[seq(plat_end + 1, length(lines))]
+      } else {
+        character(0)
+      }
+      lines <- c(lines[seq_len(pi - 1)], new_plat_lines, tail_lines)
     }
 
     # Rebuild excluded footer