feat(cdn): enable per-R-minor routing in production

Everything built today is unreachable until this is set. An R 4.6.1
client on amd64/resolute resolves against the generic index, downloads
the 4.5-built rlang (2079570 bytes) and dies at load with 'undefined
symbol: SETLENGTH', while the correct 4.6 build (2075106 bytes) sits
unused one directory away.

Verified on the staging zone first, which runs the same script against
the same origin: 16/16 slots report zero regressions against the generic
slot, an excluded R minor is sent to CRAN for sources, a client that
reports no R minor still gets the generic index, and tarball requests are
never rewritten.

Coverage on a non-primary minor drops where the per-minor build backlog
has not been worked off - resolute serves a 4.6 client 22169 packages
rather than the generic slot's 24310. Those are ABI-risky packages built
under another minor: the ones this removes are the ones that would have
failed at load.

cdn.tf

@@ -91,7 +91,17 @@ resource "bunnynet_compute_script" "rpkgs_router" {
 resource "bunnynet_compute_script_variable" "rpkgs_router_union_slots" {
   script = bunnynet_compute_script.rpkgs_router.id
   name   = "UNION_SLOTS"
-  default_value = ""
+  # Enabled. Until this was set, every client resolved against the generic
+  # index and never reached a per-minor binary: an R 4.6.1 client on resolute
+  # downloaded the 4.5-built rlang (2079570 bytes) while the correct 4.6 build
+  # (2075106 bytes) sat unused one directory away, and died at load with
+  # `undefined symbol: SETLENGTH`.
+  #
+  # Verified before enabling, against the staging zone with the same script and
+  # the same origin: all 16 slots report zero regressions against the generic
+  # slot, an excluded R minor is sent to CRAN, a client without an R minor
+  # still gets the generic index, and tarball requests are never rewritten.
+  default_value = join(",", local.rpkgs_slots)
   required      = false
 }