Add an R build strategy to the recipe schema

[jorgeMFS]

Why

R packages can be cross-compiled to WebAssembly by rwasm inside the webR container, which supplies Emscripten and a wasm-targeting LLVM flang. That makes R tools expressible as recipes — which matters because the catalogue's operations currently contain no statistics and no plotting at all, and R would also bring phylogenetics and diversity analysis.

This is the schema half only: it lets a recipe declare an R build. The builder that acts on it is a separate change.

What an R recipe declares

build:
  wasm:
    strategy: r
    r:
      packages: ["ape"]        # pkgdepends references, e.g. "ape" or "ape@5.8.1"
      dependencies: "NA"       # optional
      webrVersion: "0.6.0"

An R recipe differs from a C one in a way the schema has to carry: the build produces no per-operation binary. The artifact is a package library plus the R scripts that drive it, so an operation's bin names a script shipped with the recipe rather than something the build compiles.

Three details worth flagging for review:

• dependencies defaults to nothing. rwasm::add_pkg()'s own default is FALSE, which builds no dependencies at all — not what the name suggests, and the upstream vignette still documents the opposite. Anything with hard dependencies needs NA.
• webrVersion pins the toolchain per recipe, exactly as emscriptenVersion does for the emscripten strategy. This is not optional in practice: wasm binaries are only loadable by the webR release they were built against.
• packages requires at least one entry, the first being the package an operation script is expected to library().

Also: require a strategy to carry its settings

A recipe could previously declare strategy: emscripten with no emscripten: block, validate cleanly, and then fail deep in the build with a KeyError naming nothing the recipe author would recognise. validate_wasm_strategy closes that. auto is exempt, since it tries biowasm first and falls back to emscripten and so legitimately accepts either block.

Verification

• Ten schema cases pass, covering each rejection path: missing r block, empty packages, missing webrVersion, an invalid dependencies value, and emscripten without its block.
• Inert on the current catalogue. All 31 recipes were run through the validator before and after; zero verdicts change. All nine emscripten recipes already carry their block. (Strategies in use: 19 biowasm, 9 emscripten, 3 auto.)
• Merges cleanly against allow-native-only-recipes (Allow a recipe to declare only a native build #25) and input-sidecar-mode (Add a sidecar input mode for files located by name #26). The new function is placed after validate_output_mode, and check_with after the schema block, specifically to stay out of the region those branches edit.
• It does conflict with sbom-implementation, which inserts validate_source_identity in the same place. The two are semantically independent — it is pure adjacency and resolves by keeping both functions — but whichever lands second will have to resolve it.

Review notes

• One file, additive. It can land before or after Allow a recipe to declare only a native build #25/Add a sidecar input mode for files located by name #26.
• No recipe uses strategy: r yet, so nothing changes for the current catalogue on merge.

---

Merge order

#29 is stacked on this one and should merge after it.

sbom-implementation is the priority branch and rewrites parts of the builders. This PR conflicts with it on hub/validate/validate.py — pure adjacency, both functions are kept. Rebase after it lands.