Add a manual pipeline that installs a fixed package set from a slot under
every R minor its image carries, through each URL form the website documents,
and checks that each package loads.
The ABI bookkeeping so far reasons about the binaries: `abi_flat_safety`
records what an object's symbols say, and the index writer acts on that. None
of it proves what a client receives once the CDN rewrite, the per-minor
indexes and the `Path:` field have had their say. This closes that gap, and
runs on the build agents so arm64 is covered on real hardware rather than
skipped.
- `arch` and `generic` are contractual and fail the run.
- `flat` measures a client that hides its R minor; it is reported, never fatal.
- CRAN is deliberately absent from `repos`, so a package missing from our
index fails loudly instead of being compiled from source behind our backs.
pat-s
7414974fd8