refactor: migrate package installation from pak to uvr

bincraft dropped pak in favour of uvr, so the pipelines, helper scripts
and images in this repo move with it.

- add local/uvr-install.sh as the single replacement for pak::pak(); it
  bootstraps a pinned uvr, mints a throwaway project under TMPDIR and
  runs `uvr add --no-install` + `uvr sync --library`, because `uvr add`
  refuses to run outside a project and only `sync` honours --library
- install bincraft via its Forgejo spec (forgejo::codefloe.com/rpkgs/
  bincraft@<tag>) instead of a git:: URL, keeping the git ls-remote tag
  resolution
- pass UVR_R_BIN/UVR_TARGET_LIB from install-bincraft.R so the
  per-R-minor passes target their own R and library
- replace R_PKG_CACHE_DIR with UVR_CACHE_DIR/UVR_PACKAGES_DIR on the
  persistent volume, preserving the amd64-off/arm64-on split
- drop trim_pkgcache_metadata() and its test; uvr's cache does not grow
  the way pkgcache's _metadata dir did
- let uvr install system requirements from its vendored
  r-system-requirements rules, replacing pak::sysreqs_db_update()
- migrate the shiny app image, the alpine reprex and the CRAN loading
  test; ship uvr-install.sh in the build-one image
- track the uvr pin with renovate

local/build-all.R

@@ -27,7 +27,9 @@ package_cache_files <- c(
   "/mnt/cache/packages/s3_cache.rds"
 )
 if (!all(file.exists(package_cache_files))) {
-  message("Package snapshot missing from cache; recomputing via packages-to-build.R")
+  message(
+    "Package snapshot missing from cache; recomputing via packages-to-build.R"
+  )
   dir.create("/mnt/cache/packages", showWarnings = FALSE, recursive = TRUE)
   save_rds_atomic <- function(obj, path) {
     tmp <- paste0(path, ".tmp.", Sys.getpid())
@@ -36,7 +38,10 @@ if (!all(file.exists(package_cache_files))) {
   }
   source(file.path("local", "packages-to-build.R"))
   save_rds_atomic(pkgs, "/mnt/cache/packages/pkgs_to_build.rds")
-  save_rds_atomic(pkgs[r_minor_sensitive == TRUE], "/mnt/cache/packages/r_minor_sensitive_pkgs.rds")
+  save_rds_atomic(
+    pkgs[r_minor_sensitive == TRUE],
+    "/mnt/cache/packages/r_minor_sensitive_pkgs.rds"
+  )
   message("Package snapshot recomputed.")
 }
 
@@ -112,20 +117,22 @@ built <- DBI::dbGetQuery(
 )
 DBI::dbDisconnect(con)
 before <- nrow(chunk)
-chunk <- chunk[!paste(chunk$Package, chunk$Version) %in% paste(built$name, built$tag), ]
-sprintf("Skipped %d already-attempted package versions; %d remaining for this job", before - nrow(chunk), nrow(chunk))
+chunk <- chunk[
+  !paste(chunk$Package, chunk$Version) %in% paste(built$name, built$tag),
+]
+sprintf(
+  "Skipped %d already-attempted package versions; %d remaining for this job",
+  before - nrow(chunk),
+  nrow(chunk)
+)
 
 # Read pre-computed S3 listing from install-deps step
 # This avoids loading s3fs/reticulate/Python in the build container,
-# saving significant memory for pak subprocess forks
+# saving significant memory for the dependency-installer subprocesses
 s3_cache <- readRDS("/mnt/cache/packages/s3_cache.rds")
 sprintf("S3 cache: %s files", length(s3_cache))
 
 n <- nrow(chunk)
-# Every `trim_every` packages, bound the pkgcache _metadata dir so a full-platform
-# run does not accumulate thousands of ~70 MB snapshots and fill the host disk.
-# No-op on amd64 (R_PKG_CACHE_DIR is empty / cache not persisted).
-trim_every <- 25L
 mapply(
   function(pkg, ver, sens, i) {
     cat(sprintf("[%d/%d] %s_%s (r_minor_sensitive=%s)\n", i, n, pkg, ver, sens))
@@ -151,12 +158,6 @@ mapply(
       upload = TRUE,
       store_build_metadata = TRUE
     )
-    if (i %% trim_every == 0L) {
-      removed <- trim_pkgcache_metadata()
-      if (removed > 0L) {
-        cat(sprintf("  [pkgcache trim] removed %d stale _metadata entries\n", removed))
-      }
-    }
   },
   chunk$Package,
   chunk$Version,