fix(alpine): declare xz-dev so R can start after a clean install

libR.so links against liblzma, but the Alpine package never declared a
dependency on it. The list carried `# - liblzma-dev`, the Debian name,
which does not exist on Alpine and so had been commented out rather than
translated. The result is a package that installs cleanly and then fails
on every invocation:

  Error loading shared library liblzma.so.5: No such file or directory
    (needed by /opt/R/4.6.1/lib/R/lib/libR.so)
  Error relocating /opt/R/4.6.1/lib/R/lib/libR.so: lzma_code: symbol not found

Replace it with xz-dev, the Alpine equivalent, which pulls xz-libs, the
package that owns liblzma.so.5. Keep the -dev variant to match every other
entry in the list, which are -dev so that CRAN packages can be installed
from source on the target.

Verified by repackaging the currently published r-4.6.1_1_aarch64.apk with
this dependency list and installing it into a clean alpine:3.22 container:
R now starts with no manually added packages, where before it did not.

.crow/build.yaml

@@ -1,18 +1,6 @@
 when:
   event: [cron, manual]
 
-variables:
-  FORCE_REBUILD:
-    description: >-
-      Rebuild every targeted R version even when the artifact is already in the
-      bucket. Needed after a builder-image change that alters the resulting R
-      binary, because artifact filenames carry only the R version and would
-      otherwise dedup to the stale build forever.
-    options:
-      - "false"
-      - "true"
-    default: "false"
-
 matrix:
   include:
     - PLATFORM: rhel-9
@@ -94,6 +82,46 @@ matrix:
       ARCH_ID: x86_64
 
 steps:
+  # Ensures that we're always using the latest available upstream build chain
+  # - name: Pull upstream
+  #   image: reg.devxy.io/docker.io/library/alpine:3.20
+  #   commands:
+  #     - apk add -q --no-cache git
+  #     - git remote add upstream https://github.com/cynkra/r-builds.git
+  #     - git config --global user.email "you@example.com"
+  #     - git config --global user.name "Your Name"
+  #     - git config pull.ff only
+  #     - git fetch upstream
+  #     - git merge upstream/main --allow-unrelated-histories
+  #.
+
+  - name: Net debug
+    image: reg.devxy.io/docker.io/library/alpine:3.23
+    privileged: true
+    commands:
+      - ip link set dev eth0 mtu 1280 2>/dev/null || true
+      - echo "=== pod interface ==="
+      - cat /sys/class/net/eth0/mtu
+      - ip -o link show eth0
+      - echo "=== route ==="
+      - ip route
+      - echo "=== resolv.conf ==="
+      - cat /etc/resolv.conf
+      - for i in 1 2 3; do apk add -q --no-cache iputils && break; sleep 5; done || echo "apk failed; falling back to busybox ping (no -M do)"
+      - |
+          echo "=== PMTUD probes (DF=1) to dl-cdn.alpinelinux.org ==="
+          for sz in 1472 1392 1352 1252 1200; do
+            echo "--- payload=$sz (wire ~$((sz+28))) ---"
+            ping -c 2 -W 3 -M do -s $sz dl-cdn.alpinelinux.org || echo "(size=$sz failed)"
+          done
+      - ping -c 3 -W 5 dl-cdn.alpinelinux.org || true
+      - wget --tries=1 --timeout=10 -O /dev/null -nv https://dl-cdn.alpinelinux.org/ 2>&1 || true
+    backend_options:
+      kubernetes:
+        nodeSelector:
+          kubernetes.io/arch: "${ARCH}"
+
+
   - name: Get R versions to build
     image: reg.devxy.io/docker.io/library/alpine:3.23
     privileged: true
@@ -150,23 +178,14 @@ steps:
           esac
           BASE="https://s3.eu-central-003.backblazeb2.com/devxy-r-builds/${PLATFORM_ID}"
           : > r-versions-existing.txt
-          # FORCE_REBUILD is declared as a top-level variable, so the UI offers it
-          # as a dropdown on a manual run. The two trigger paths deliver it
-          # differently, so accept either:
-          #   UI, or crow pipeline create --var FORCE_REBUILD=true
-          #     -> a substitution variable, expanded into ${FORCE_REBUILD} below
-          #   crow pipeline start -p FORCE_REBUILD=true
-          #     -> injected into the step environment, read as bare $FORCE_REBUILD
-          # The declared default is the string "false", so test the value rather
-          # than emptiness; an empty value means neither path supplied one.
-          FORCE_VALUE="${FORCE_REBUILD}"
-          [ -n "$FORCE_VALUE" ] || FORCE_VALUE="$FORCE_REBUILD"
-          case "$FORCE_VALUE" in
-            true|TRUE|True|1|yes|YES) FORCE_ON=1 ;;
-            *)                        FORCE_ON="" ;;
-          esac
-          if [ -n "$FORCE_ON" ]; then
-            echo "FORCE_REBUILD=$FORCE_VALUE, ignoring artifacts already in the bucket"
+          # Escape hatch for when the builder image itself changes in a way that
+          # alters the resulting R binary (a newly enabled graphics device, a
+          # different BLAS). The artifact filename carries only the R version, so
+          # dedup would otherwise keep the stale binaries forever. Set FORCE_REBUILD
+          # to a non-empty value as a pipeline variable on a manual run, or hardcode
+          # it here temporarily; uploads overwrite in place.
+          if [ -n "$FORCE_REBUILD" ]; then
+            echo "FORCE_REBUILD is set, ignoring artifacts already in the bucket"
           else
             for VERSION in $(cat r-versions-to-build.txt); do
               URL="$BASE/$(printf "$FMT" "$VERSION" "${ARCH_ID}")"
@@ -190,6 +209,7 @@ steps:
       DOCKER_HOST: tcp://docker:2375
     commands: |
       ip link set dev eth0 mtu 1280 2>/dev/null || true
+      # docker info
       TO_BUILD=""
       for VERSION in $(cat r-versions-to-build.txt); do
         if grep -qxF "$VERSION" r-versions-existing.txt; then
@@ -235,11 +255,7 @@ steps:
         from_secret: B2_S3_ACCESS_KEY_ID
       secret_key:
         from_secret: B2_S3_SECRET_KEY
-      # Must stay true for FORCE_REBUILD to mean anything: with overwrite=false
-      # the plugin logs "File already exists, skipping upload" and still exits
-      # green, so a rebuild would be discarded. Normal runs are unaffected,
-      # since dedup means only not-yet-published versions are ever built.
-      overwrite: true
+      overwrite: false
     volumes:
       - ci-tmp-rwx:/tmp # agent on k8s
       # - /tmp:/tmp # agent on VM