feat(abi): repair from the recorded verdicts rather than an ad-hoc scan (#206)

## Why

The reprex found 44 routed-path failures: `Rcpp`, `Matrix` and `RJSONIO` served to R 4.4 from 4.5 builds. Two causes, both now fixed (#205 here, #129 in bincraft) — but the repair itself also needs redoing, and the lists it ran from no longer exist.

Those lists came from a one-off local symbol scan, seeded from a candidate set derived on a single slot. That made them a lower bound by construction: the scan found 846 package-slot pairs, while inspecting every object found **4077** unsafe.

`abi_flat_safety` now holds the authoritative answer for every slot, written by the flat-safety backfill from the binaries themselves:

```
95418 inspected, 91325 safe, 4077 unsafe (4.3%)
```

against the 93% of compiled packages the source classifier suspects.

## What it does

- `local/list-unsafe-flat-objects.R` prints the objects recorded as unable to load under some minor, for one slot.
- The workflow rebuilds each under **every** R minor installed in the image, with **no `--sensitive-only` gate**. Since bincraft v5.3.0 the destination is decided by the built binary's symbols, so a package needing a per-minor slot lands there and a portable one lands in the flat slot. Gating on the source classifier is exactly what let `Rcpp` slip through.

## Safety

It **fails loudly when a slot has no verdicts at all**, rather than printing an empty list. An empty repair list is indistinguishable from "nothing to repair" and would read as success while doing nothing — the same shape of silent failure as the missing `PGPASS`.

`crow lint` passes.

## After this

Run it fleet-wide, re-index, then re-run the reprex. The routed paths are the ones that must come back clean; the `flat` form's failures are the separate prune question.

Reviewed-on: #206

local/list-unsafe-flat-objects.R

@@ -0,0 +1,80 @@
+### Print the flat-slot objects recorded as unable to load under some R minor.
+#
+# Usage: Rscript local/list-unsafe-flat-objects.R <arch> <codename>
+#
+# Prints one `<package> <version>` per line, for a caller that rebuilds each
+# under every installed R minor.
+#
+# The verdicts come from `abi_flat_safety`, written by the flat-safety backfill
+# from the binaries themselves: an object is unsafe when it references a symbol
+# some supported minor does not export. That is the authoritative list of what
+# needs a per-minor build, and it replaces the ad-hoc symbol scans that produced
+# earlier repair lists.
+
+options(error = function() {
+  cat("ERROR:", geterrmessage(), "\n", file = stdout())
+  q(status = 1)
+})
+
+args <- commandArgs(trailingOnly = TRUE)
+if (length(args) < 2L) {
+  stop("usage: list-unsafe-flat-objects.R <arch> <codename>", call. = FALSE)
+}
+arch <- args[[1L]]
+codename <- args[[2L]]
+
+con <- DBI::dbConnect(
+  RPostgres::Postgres(),
+  dbname = "build_metadata",
+  host = "r-binaries.devxy.io",
+  port = 15432L,
+  user = "rpkgs",
+  password = Sys.getenv("PGPASS"),
+  sslmode = "require"
+)
+on.exit(try(DBI::dbDisconnect(con), silent = TRUE), add = TRUE)
+
+rows <- DBI::dbGetQuery(
+  con,
+  paste0(
+    "SELECT package, version FROM abi_flat_safety ",
+    "WHERE NOT safe AND codename = $1 AND arch = $2 ",
+    "ORDER BY package, version"
+  ),
+  params = list(codename, arch)
+)
+
+# An empty result is ambiguous: either nothing is unsafe, or the backfill never
+# ran for this slot. Say which, rather than let the caller read silence as done.
+if (nrow(rows) == 0L) {
+  total <- DBI::dbGetQuery(
+    con,
+    "SELECT count(*) AS n FROM abi_flat_safety WHERE codename = $1 AND arch = $2",
+    params = list(codename, arch)
+  )$n[[1L]]
+  if (total == 0L) {
+    stop(
+      sprintf(
+        "No verdicts recorded for %s/%s at all. Run the flat-safety backfill first; an empty repair list here would look like success.", # nolint
+        arch,
+        codename
+      ),
+      call. = FALSE
+    )
+  }
+  message(sprintf(
+    "%s/%s: %d objects recorded, none unsafe. Nothing to repair.",
+    arch,
+    codename,
+    total
+  ))
+  quit(status = 0)
+}
+
+message(sprintf(
+  "%s/%s: %d objects need a per-minor build",
+  arch,
+  codename,
+  nrow(rows)
+))
+cat(sprintf("%s %s", rows$package, rows$version), sep = "\n")