build-all reads a static pkgs_to_build.rds produced once by the install-deps
step, so a restarted build job re-cycles every package an interrupted run
already produced. Query the build-metadata DB at job start and drop the
(Package, Version) pairs already built successfully for this platform/arch,
so a restart only processes what is genuinely left.
Relies on bincraft writing the success row only after a confirmed S3 upload
(rpkgs/bincraft#56), so a DB success guarantees the binary is published.