refactor: migrate package installation from pak to uvr

bincraft dropped pak in favour of uvr, so the pipelines, helper scripts
and images in this repo move with it.

- add local/uvr-install.sh as the single replacement for pak::pak(); it
  bootstraps a pinned uvr, mints a throwaway project under TMPDIR and
  runs `uvr add --no-install` + `uvr sync --library`, because `uvr add`
  refuses to run outside a project and only `sync` honours --library
- install bincraft via its Forgejo spec (forgejo::codefloe.com/rpkgs/
  bincraft@<tag>) instead of a git:: URL, keeping the git ls-remote tag
  resolution
- pass UVR_R_BIN/UVR_TARGET_LIB from install-bincraft.R so the
  per-R-minor passes target their own R and library
- replace R_PKG_CACHE_DIR with UVR_CACHE_DIR/UVR_PACKAGES_DIR on the
  persistent volume, preserving the amd64-off/arm64-on split
- drop trim_pkgcache_metadata() and its test; uvr's cache does not grow
  the way pkgcache's _metadata dir did
- let uvr install system requirements from its vendored
  r-system-requirements rules, replacing pak::sysreqs_db_update()
- migrate the shiny app image, the alpine reprex and the CRAN loading
  test; ship uvr-install.sh in the build-one image
- track the uvr pin with renovate

local/install-bincraft.R

@@ -11,10 +11,11 @@
 #
 # How it works: list the remote tags with `git ls-remote` (no token needed for
 # the public repo), keep the `vX.Y.Z` release tags, pick the highest version,
-# and install it with pak. pak is idempotent on the git ref, so re-running keeps
-# the package when it is already current and only updates when a newer tag ships.
-# Filtering/sorting is done in R (not via git's `--sort`/refspec) so behaviour is
-# identical across git versions and `system2()` argument handling.
+# and install it with uvr via `local/uvr-install.sh`. uvr is idempotent on the
+# git ref, so re-running keeps the package when it is already current and only
+# updates when a newer tag ships. Filtering/sorting is done in R (not via git's
+# `--sort`/refspec) so behaviour is identical across git versions and
+# `system2()` argument handling.
 
 repo_url <- Sys.getenv(
   "BINCRAFT_GIT_URL",
@@ -44,7 +45,43 @@ latest <- tags[order(package_version(sub("^v", "", tags)), decreasing = TRUE)][
 ]
 
 message(sprintf("Installing latest bincraft release: %s", latest))
-pak::pak(sprintf("git::%s@%s", repo_url, latest))
+
+# uvr addresses Forgejo repos as `forgejo::host/owner/repo@ref` rather than as a
+# git URL, so drop the scheme and the trailing `.git` from `repo_url`.
+spec <- sprintf(
+  "forgejo::%s@%s",
+  sub("\\.git$", "", sub("^[a-z]+://", "", repo_url)),
+  latest
+)
+
+# `local/uvr-install.sh` when run from the repo root, `/work/local/` in the
+# build-one image, which copies the two scripts into a flatter layout.
+helper <- Sys.getenv("UVR_INSTALL_SH", unset = "")
+if (!nzchar(helper)) {
+  candidates <- c("local/uvr-install.sh", "/work/local/uvr-install.sh")
+  found <- candidates[file.exists(candidates)]
+  if (length(found) == 0L) {
+    stop("Could not locate uvr-install.sh; set UVR_INSTALL_SH", call. = FALSE)
+  }
+  helper <- found[1L]
+}
+
+# Point uvr at the R running this script and at the library it would install
+# into, so the per-R-minor passes in the build pipelines (which call a different
+# Rscript with R_LIBS_USER pointed elsewhere) target their own R and library.
+Sys.setenv(
+  UVR_R_BIN = file.path(R.home("bin"), "R"),
+  UVR_TARGET_LIB = .libPaths()[1L]
+)
+
+status <- system2(helper, shQuote(spec))
+if (!identical(status, 0L)) {
+  stop(
+    sprintf("uvr failed to install %s (exit %s)", spec, status),
+    call. = FALSE
+  )
+}
+
 message(sprintf(
   "bincraft %s installed (%s)",
   as.character(utils::packageVersion("bincraft")),