fix(alpine): build R with cairo, png, jpeg and tiff graphics devices

The Alpine builder images install R-dev but never the graphics headers.
R's configure treats those as optional and does not fail when they are
absent, so the build succeeds and ships an R whose capabilities() reports
cairo, png, jpeg and tiff as FALSE. Installing the runtime libraries on
the target system afterwards cannot bring compiled-out devices back.

Note that --with-x=no was not the cause. R's bitmap and pangocairo checks
run independently of R_X11, and libpng was in fact found. capabilities("png")
needs a device backend, and with X11 off and cairo absent there was none,
which is why all four read FALSE. X11 stays off: these are headless images
and cairo covers png()/jpeg()/tiff()/svg().

- Install pkgconf, cairo-dev, pango-dev, fontconfig-dev, freetype-dev,
  libpng-dev, jpeg-dev, tiff-dev and zlib-dev in every Alpine builder image.
- Pass --with-cairo, --with-libpng, --with-jpeglib and --with-libtiff
  explicitly so the intent is visible next to --with-x=no.
- Assert REQUIRED_CAPABILITIES after make install, so a build that loses a
  device fails instead of being packaged and uploaded. Opt-in per Dockerfile,
  leaving the other platforms untouched.
- Add a FORCE_REBUILD escape hatch to the dedup step. Artifact filenames
  carry only the R version, so the HEAD probe would otherwise keep skipping
  every Alpine version and serving the stale broken binaries.
- Record the three gotchas in CLAUDE.md.

Verified by compiling R 4.5.1 in the patched alpine-322 image: jpeg, png,
tiff and cairo are TRUE, default bitmapType is cairo, and all four devices
render. The guard was exercised in both directions against that build.

.crow/build.yaml

@@ -178,12 +178,22 @@ steps:
           esac
           BASE="https://s3.eu-central-003.backblazeb2.com/devxy-r-builds/${PLATFORM_ID}"
           : > r-versions-existing.txt
-          for VERSION in $(cat r-versions-to-build.txt); do
-            URL="$BASE/$(printf "$FMT" "$VERSION" "${ARCH_ID}")"
-            if [ "$(curl -s -o /dev/null -w '%{http_code}' -I "$URL")" = "200" ]; then
-              echo "$VERSION" >> r-versions-existing.txt
-            fi
-          done
+          # Escape hatch for when the builder image itself changes in a way that
+          # alters the resulting R binary (a newly enabled graphics device, a
+          # different BLAS). The artifact filename carries only the R version, so
+          # dedup would otherwise keep the stale binaries forever. Set FORCE_REBUILD
+          # to a non-empty value as a pipeline variable on a manual run, or hardcode
+          # it here temporarily; uploads overwrite in place.
+          if [ -n "$FORCE_REBUILD" ]; then
+            echo "FORCE_REBUILD is set, ignoring artifacts already in the bucket"
+          else
+            for VERSION in $(cat r-versions-to-build.txt); do
+              URL="$BASE/$(printf "$FMT" "$VERSION" "${ARCH_ID}")"
+              if [ "$(curl -s -o /dev/null -w '%{http_code}' -I "$URL")" = "200" ]; then
+                echo "$VERSION" >> r-versions-existing.txt
+              fi
+            done
+          fi
       - echo "Already present in s3:"; cat r-versions-existing.txt
     backend_options:
       kubernetes: