Port the translators to the moveapps R package

[cleemansen]

Trello 1402 — port both translator Apps to the current R co-pilot, which ships the SDK as the moveapps R package.
Design and measurements: docs/superpowers/specs/2026-09-30-port-to-moveapps-package-design.md; task plan next to it.

Why

Since R co-pilot v4 the SDK is a package and the image has no src/, so the App Dockerfile broke at mv ../src.
Nothing but the platform ever built that Dockerfile, which is how the break stayed invisible.

What

• Port. rds_2_csv.R / csv_2_rds.R call moveapps (still no move1). The conversion moved, unchanged, into
  testable functions in r/link.R. r/src/ is gone. r/renv.lock is re-snapshotted for R 4.6.1 / renv 1.2.4 /
  moveapps 1.0.3 — seven direct packages, no testthat.
• One Dockerfile, both Apps. FROM the current R co-pilot; conda is copied from the python co-pilot's image
  (/opt/conda checksummed identical to condaforge/miniforge3:26.7.2-0) instead of a Miniforge installer fetched
  from "latest". ARG DIRECTION has no default: a forgotten edit fails the build instead of building the other App.
• Python lock. The App and the python tests install python/conda-linux-64.lock (explicit, 161 packages, plain
  conda) instead of resolving environment.yml at build time, so an App version gets exactly what CI tested.
  python/lock.sh resolves it from environment.yml, which stays open; refresh it before a release. The weekly run
  tests a fresh resolution and warns when the lock is behind; CI fails while the lock was not made from the current
  environment.yml.
• Tests.
  • python: 10 → 17 tests, including a contract test against golden CSV pairs.
  • R: 0 → 56 testthat expectations (unit tests per function, the same goldens).
  • CI job app: builds the real Dockerfile for both directions on a public stand-in for the private co-pilot
    (docker buildx bake), runs coherence checks of the version pins, the R tests and a round trip
    R → python → R of 12 cases inside the images, and requires a build without a valid DIRECTION to fail at the check.
  • The goldens and round-trip expectations were produced by the v2.2.0 production images; every later commit
    proves itself by reproducing them.
• Defects found by the new tests, fixed one commit each (each commit's diff of the pins is its evidence):
  1. An empty TrajectoryCollection failed with "No objects to concatenate" — it now becomes the NULL output the README
     promises.
  2. R wrote wall-clock times and python re-localised them: two fixes in the repeated autumn hour collided
     (AmbiguousTimeError). link.csv now carries UTC instants; UTC data — all Movebank data — stay byte-identical.
  3. R parsed python's times with %S and dropped fractions: up to 0.999 s off. Now %OS.
  4. R's %OS3 truncates: a time stored just below its millisecond lost it on the way to python (10 of 75
     sub-second fixes in the stork sample, 1 ms early). Rounded now; no golden changes.
  5. movingpandas drops single-fix tracks silently. The App log now names every dropped track.
  6. python's True/False came back as character; logical columns now come back as logical.

Not obvious from the diff

• The start script is picked in RUN, not by COPY ${DIRECTION}.sh. BuildKit resolves a COPY source before the
  preceding RUN check executes, so a build without DIRECTION failed on "/.sh": not found — and a grep for the
  check's message still matched, because the log quotes the command. The CI grep is anchored to the message at the
  line end; both positive builds give 0 matches, both negative ones 2.
• ~/.cache/conda is created as root. The co-pilot's install -d … $HOME/.cache/R leaves ~/.cache owned by
  root, and conda env create fails on its notices cache. The stand-in reproduces the co-pilot, so CI sees the same.
• Lock repositories are CRAN. The snapshot was taken with P3M binaries (minutes instead of hours, emulated);
  renv then recorded the P3M URL per package. Normalised to CRAN; the co-pilot's repo override decides at restore.
• R time assertions compare absolute differences. expect_equal's tolerance is relative: at 1.4e9 s its
  default forgives ~20 s, so a pin of "v2.2.0 truncates sub-seconds" passed with and without the truncation.

Proofs (local, Apple Silicon, amd64 emulated)

• Refactoring: this branch's R files inside the v2.2.0 production images reproduce every golden and pin (no diff).
• Port and every fix: both Apps built on the real co-pilots reproduce the pins the public stand-in measures
  (no diff) — CI and production agree.
• Downstream: every new output.rds (11 cases) is read by the v2.2.0 R → python App, exit 0 — R Apps that were not
  rebuilt keep working.
• DIRECTION: missing and invalid are refused on the real co-pilot, with the message.
• Mutations: a changed pin, a changed Miniforge tag, a changed R expectation and an environment.yml edit without a
  new lock each fail the bake suite; a stale lock shows up in the drift report.

After merge

Tag v3.0.0 - a major release: downstream Apps see logical columns as logical instead of character, times
with their fractions of a second, and NULL instead of a failure for an empty TrajectoryCollection. The python lock
is from 2026-10-01; refresh it first if the weekly run reports it behind. Then one App version per translator. Its Dockerfile is this Dockerfile with exactly one line changed:

• move2_loc to MovingPandas: ARG DIRECTION → ARG DIRECTION=r2python
• MovingPandas to move2_loc: ARG DIRECTION → ARG DIRECTION=python2r

The app job's first cold run took 8m36s; its timeout-minutes is 20.