feat(dock_from_renv): default FROM = rocker/r-ver, repos = p3m.dev/cran/latest

[VincentGuyader]

Summary

Closes #47 and #57.

Two coordinated default flips on dock_from_renv():

1. FROM: "rocker/r-base" -> "rocker/r-ver"

• Previous default "rocker/r-base" is amd64-only, forcing
  Rosetta emulation on Apple Silicon and ARM Linux hosts
  (Ampere, AWS Graviton).
• New default "rocker/r-ver" is multi-arch (linux/amd64 +
  linux/arm64). The R version from the renv.lock file is
  appended at codegen time via the existing gen_base_image()
  helper, so the generated Dockerfile gets a fully-pinned
  FROM rocker/r-ver:4.5.0 line.
• Opt-out: dock_from_renv(FROM = "rocker/r-base").

2. repos: "https://cran.rstudio.com/" -> "https://p3m.dev/cran/latest"

• Previous default served R source packages -> packages with
  C/C++ deps recompile from source on every docker build (minutes
  per package).
• New default is the Posit Public Package Manager. The existing
  .patch_rprofile_for_ppm() rewrite logic kicks in to convert
  the URL to the __linux__/$VERSION_CODENAME/ shape so the
  build pulls pre-compiled Linux binaries instead of source.
  Build time drops from minutes to seconds for typical package
  sets.
• The PPM rewrite regex now matches all three Posit-managed PPM
  hosts: packagemanager.posit.co, packagemanager.rstudio.com,
  and p3m.dev.
• Opt-out: dock_from_renv(repos = c(CRAN = "https://cran.rstudio.com/")).

Behaviour change

For users regenerating their Dockerfile without specifying FROM
or repos:

-FROM rocker/r-base
+FROM rocker/r-ver:4.5.0
 ARG RENV_PATHS_CACHE=...
 ENV "RENV_PATHS_CACHE"=...
-RUN echo "options(repos = c(CRAN = 'https://cran.rstudio.com/'), ...)" | tee Rprofile.site
+RUN . /etc/os-release && echo "options(renv.config.pak.enabled = FALSE, renv.config.repos.override = c(CRAN = 'https://p3m.dev/cran/__linux__/$VERSION_CODENAME/latest'), repos = c(CRAN = 'https://p3m.dev/cran/__linux__/$VERSION_CODENAME/latest'), ..., HTTPUserAgent = sprintf('R (%s %s %s %s)', ...))" | tee Rprofile.site

Both opt-outs are clearly documented in @param FROM and
@param repos.

Test plan

• TDD red-first: 4 new test_that blocks in
  test-dock_from_renv.R. Each was confirmed red against the
  pre-fix tree by mental revert / git stash.
• Existing fixture test: patched to pass explicit
  repos = c(CRAN = "https://cran.rstudio.com/") so the basic
  Dockerfile shape stays locked against the unchanged fixture
  file.
• devtools::test(): [ FAIL 0 | WARN 3 | SKIP 0 | PASS 323 ].
• R CMD check --as-cran: 0 errors / 0 warnings / 1 note
  (transient host "unable to verify current time", unrelated).
• pr-reviewer APPROVE clean (2 nits folded before push).

Compose with #109

The new defaults flow through the .validate_FROM / .validate_repos
helpers added in #109. Both defaults pass validation; no new
injection vector introduced.

Context

Path C of the post-CRAN-prep roadmap (config decisions deferred
until after the security audit). Closes the last two issues
identified as "Tier C config decisions" in
/home/ubuntu/thinkr-work/dockerfiler-cran-0.3.0-prep.md.

After this lands, master is ready for the CRAN release sequence
(étape 5 = check_win_devel + urlchecker + revdepcheck,
étape 6 = devtools::release()).