fix(rebuild): harden split workflow setup

This change will:\n\n- retry transient uvr dependency resolution failures with bounded backoff\n- reuse the re-index checkout when purging the CDN

.crow/weekly-rebuild-reindex.yaml

@@ -173,14 +173,12 @@ steps:
       OTEL_R_METRICS_EXPORTER: none
       BUNNYNET_API_KEY:
         from_secret: BUNNYNET_API_KEY
-      REPO_RO_TOKEN:
-        from_secret: REPO_RO_TOKEN
       # All hostnames on the zone share this id, so one purge covers
       # cran.devxy.io, cran.allianceswisspass.devxy.io and cran.rpkgs.com.
       BUNNY_PULLZONE: '3857050'
     commands:
-      - apk add --no-cache -q bash curl git
-      - git clone -q https://pat-s:$$REPO_RO_TOKEN@git.devxy.io/devxy/build-cran-binaries.git .
+      - apk add --no-cache -q bash curl
+      # Crow carries the checkout from the re-index step into this step.
       - bash scripts/purge_cdn_zone.sh "$BUNNYNET_API_KEY" "$BUNNY_PULLZONE"
     # Runs on every row rather than on one designated slot: a cron fires only
     # its own slot's row, so gating on a named slot would leave every other

local/uvr-install.sh

@@ -84,9 +84,20 @@ trap 'rm -rf "$project_dir"' EXIT
 cd "$project_dir"
 
 "$uvr_bin" init --here --r-version "$r_full"
-# --no-install: resolve and lock only. The install happens in the sync below,
-# which is the only command that honours --library.
-"$uvr_bin" add --no-install "$@"
+# --no-install resolves and locks only; retry because concurrent shards can
+# expose short-lived DNS or CRAN-index failures and uvr rolls the manifest back
+# cleanly after an unsuccessful resolution.
+add_attempt=1
+while ! "$uvr_bin" add --no-install "$@"; do
+  if [ "$add_attempt" -ge 4 ]; then
+    echo "error: uvr add failed after ${add_attempt} attempts" >&2
+    exit 1
+  fi
+  add_delay=$((add_attempt * 10))
+  echo "warning: uvr add attempt ${add_attempt} failed; retrying in ${add_delay}s" >&2
+  sleep "$add_delay"
+  add_attempt=$((add_attempt + 1))
+done
 
 # TEMPORARY (drop once the images ship a uvr above v0.4.5): the sync below runs
 # `apt-get install` for every resolved system dependency without refreshing the