Run R CMD check in CI on three platforms

[NewGraphEnvironment]

Closes #52.

.github/workflows/ held only pkgdown.yaml, so a green PR check meant the docs site
built. R CMD check had never run anywhere but the author's machine, and neither had the
test suite.

What landed

R CMD check on ubuntu, macOS and Windows at R release, on every push to main and
every PR, gating at the r-lib action's default error-on: "warning".

Three platforms, and the platform axis is the one that earns the runner time. fly
reaches GDAL through sf::gdal_utils() for warp, translate and nearblack, and
fly_mask() asks for -alg floodfill — which GDAL's own nearblack.rst marks
versionadded:: 3.8. The three runners take GDAL from three different sources, and
test-fly_mask.R synthesizes its own images with terra, so it exercises that call
offline on all three. R devel and oldrel-1 are deliberately absent: fly is not going
to CRAN, and oldrel-1 is R 4.4, far above the declared Depends: R (>= 4.1).

The gate sits at "warning" because the one pre-existing WARNING is cleared here.
R/fly_mask.R carried a raw em dash in a warning message; it is now —, the remedy
R CMD check names and the form R/fly_footprint.R and R/fly_georef.R already use
eleven times between them. The rendered message is byte-identical, verified against the
parsed string value rather than a deparse(). The alternative was error-on: "error",
which passes with a WARNING present — that is what makes it tempting and what makes it
weak, since it would also have passed over the next one. gq#51 took that route and is
still open.

A "Report skipped tests" step. The action already cats the raw testthat output, so
this step's job is narrower than a first draft claimed: the skip block on its own rather
than buried in a collapsed dump, and a failure when the output cannot be read at all,
where the action's version ends in || true. All four of its branches were driven against
fixture trees, including the one that must fail.

The blocker a review found, and the measurement that settled it

A concurrent plan review found that the workflow's own comment asserted a safety property
the package did not have. Seven blocks in test-fly_georef.R fetched thumbnails from the
BC Data Catalogue with no guard at all, four of them asserting result$success
directly on a fresh download.

Measured by routing HTTP at a dead local port — so DNS still resolves and
skip_if_offline() passes, isolating the fetch guard as the thing under test — with the
pre-change file pulled from git rather than reconstructed:

test-fly_georef.R	FAIL	SKIP	PASS
as it stood	11	2	10
with the guards	0	9	7

So a hiccup at the catalogue would have reddened three runners on an unrelated diff, which
is how a gate teaches people to ignore it — #52's own complaint in a new form. All seven
now carry skip_if_offline() + skip_if_not(all(fetched$success)), the pattern the two
#49-era blocks below them already used.

The same edit moves fourteen shared fixed tempdir() names to withr::local_tempdir():
unlink() fails silently on Windows when a handle is open, and fly_fetch() then
serves the stale file as a cache hit.

Measured, not assumed

rcmdcheck with the action's exact inputs and the two env vars the action forces —
_R_CHECK_CRAN_INCOMING_=false, _R_CHECK_FORCE_SUGGESTS_=false — gives 0 errors,
0 warnings, 0 notes in 207 s. Suite: FAIL 0, PASS 2144. A bare local rcmdcheck()
without those env vars is measuring a different check, and reports a CRAN-incoming NOTE
this workflow will never see.

The commits are ordered workflow-first on purpose. The WARNING fix comes second, so
this PR's first run goes red on the real pre-existing WARNING and the next goes green. A
gate nobody has seen reject anything is indistinguishable from one that cannot.

Six claims made along the way were wrong

Recorded as wrong in planning/, not quietly re-pointed:

• The non-ASCII WARNING names one file, not three. The probe that named three parsed
  each file and ran deparse() over the parse tree — which renders — back as a
  literal em dash, so it measured its own un-escaping and reported the existing fix as the
  defect. The probe that agrees with the check is
  tools:::.check_package_ASCII_code(dir, FALSE).
• The predicted utils/stats undeclared-import NOTE does not exist — they are base
  packages. The DESCRIPTION edit it implied was struck rather than made for no reason.
• The concurrency group carried no matrix value, so all three runners shared one
  group and cancel-in-progress would have made them cancel each other — and a
  cancelled run reads as cancelled, not failure, so two platforms would simply never
  have reported. That defect sat inside a fix for an earlier review finding.
• A comment inverted error-on semantics.
• The GDAL premise asserted >= 3.7, the figure this repo's own conventions carry.
  Upstream says 3.8, so the guard would have passed on a build with no -alg flag at
  all — failing toward pass on precisely the release it exists to catch. Filed as
  NewGraphEnvironment/soul#255.
• package_version() errors on a pre-release GDAL string ("3.9.0beta1",
  "3.11.0-dev"), so the premise would have reddened a correct package on such a runner.
  The suffix is now stripped and the strip's own output asserted.

Six of twenty-six claims, across three populations enumerated by count. None was reachable
by reading the files again. The review loop ended on that enumeration rather than on a
quiet round, which is the rule once a defect has been found inside a fix.

Adjacent, filed rather than folded in

• R CMD build ships the .git FILE when built from a worktree #66 — .Rbuildignore has no ^\.git$, so a build from a worktree ships an absolute
  developer path. Reviewed and argued for during this work; it was scoped out at the plan
  gate, so it is filed rather than slipped in. The issue carries the reviewer's point that
  CI is structurally incapable of catching it, and that the assertion the conventions
  prescribe has a placement problem of its own.
• NewGraphEnvironment/soul#255 — the GDAL version error above, in a shared convention
  that reaches every repo.
• Recorded and not fixed: test-fly_fetch.R is vacuous under an outage (FAIL 0, SKIP 0,
  PASS 13 measured). Pre-existing, out of scope, written down so it is not rediscovered as
  a surprise.

What the first CI run found

Run 35680424973, on
the workflow-only commit, went red on the non-ASCII WARNING across all three platforms —
the gate demonstrated on a runner rather than asserted locally.

It also found two pre-existing defects, neither reachable from this machine. That is
the argument for the three-platform matrix, made by the matrix on its first run rather than
by anyone's reasoning about it:

• test-fly_footprint.R's anti-vacuity premise is a property of the BLAS. It asserts
  the pre-Bearing rotation for diagonal flight lines — film half (resolved: the mapping is per-roll, not a constant) #26 recomputed ring close still fails somewhere in a 720-bearing sweep, so the
  test cannot quietly become decoration. Measured: 342 of 720 bearings differ on this
  machine, 0 of 720 on all three runners — where asserting it took the whole check red.
  Split into its own block that skips when the defect is unreachable and asserts when it is
  not, with the skip printed by the new skip-report step rather than being silent.
• Windows contradicts a documented invariant. Masking a grayscale frame there yields
  2 bands against 1 with masking off; ubuntu and macOS both give 1. CLAUDE.md's Key
  Decision that "output band counts do not change" — the stated reason masking could
  default to on without moving stac_airphoto_bc — was measured on one platform and
  written down unconditionally. Filed as Masking adds a band on Windows for grayscale, so "output band counts do not change" is platform-conditional #68. The observed Windows value is pinned
  rather than skipped, so nothing goes unasserted and the test reddens if that platform
  moves in either direction, including the direction where Masking adds a band on Windows for grayscale, so "output band counts do not change" is platform-conditional #68 is fixed.