don't treat biocViews as proof of bioconductor origin

[kevinushey]

Problem

renv used the presence of a biocViews field in a package's DESCRIPTION as "proof" that the package came from Bioconductor (#2128, problem 1). But some CRAN packages legitimately declare biocViews, and Posit Package Manager can serve Bioconductor packages from a CRAN-like "R repository". In those cases renv misclassified the package: it recorded Source: Bioconductor, activated the Bioconductor repositories, and injected a Bioconductor/BiocVersion block into the lockfile -- pulling the package from bioconductor.org instead of the repository it actually came from.

Approach

The key insight is that what matters for restore is where a package was obtained (the Repository field) rather than where it originally came from (its git provenance). A genuine Bioconductor package's DESCRIPTION carries Repository: Bioconductor <ver> (and git_url: https://git.bioconductor.org/...); a CRAN/PPM package carries Repository: CRAN (or a repo name).

• New helper renv_description_bioconductor(dcf) (R/bioconductor.R) decides origin by precedence:

  1. no biocViews -> not Bioconductor;
  2. Repository contains "Bioconductor" (matched anywhere, case-insensitive, so custom-named PPM Bioconductor repositories are recognized) -> Bioconductor;
  3. Repository is CRAN / a known mirror / one of the active repos -> not Bioconductor (covers CRAN packages and PPM CRAN-like "R repositories", even when they retain Bioconductor git provenance);
  4. otherwise fall back to git_url provenance, then to the historical behaviour of trusting biocViews.

• The snapshot classification, _source_custom, field-strip blocks, retrieve.R repo activation, graph.R resolution, install.R, and lockfile.R call sites are rewired to use this (and the new setting below) instead of a bare nzchar(biocViews) check. Because the lockfile Bioconductor block is driven by Source == "Bioconductor", correcting classification also resolves the unwanted BiocVersion/repo injection (problem 2) for the misclassified case.

• New bioconductor.enabled project setting (logical, default TRUE, persisted in renv/settings.json). When FALSE, renv never infers a Bioconductor source, activates the Bioconductor repositories, or writes a Bioconductor entry into the lockfile -- a first-class opt-out for repository-only projects, replacing the options(renv.bioconductor.repos = ...) workaround.

Notes on PPM / mirrors

renv does not hard-code Bioconductor URLs: it asks BiocManager (which honors BioC_mirror) for the repositories, or uses the renv.bioconductor.repos override verbatim. So a PPM Bioconductor mirror is used automatically when configured, and needs no special handling here. The vignette is updated to explain the BioC_mirror vs renv.bioconductor.repos distinction and the reproducibility options. Capturing the mirror in the lockfile was considered and deliberately left out of scope.

Testing

Added snapshot tests covering: CRAN + biocViews -> Repository; a CRAN-like (PPM) repo + biocViews + bioc git provenance -> Repository; genuine Repository: Bioconductor and custom-named PPM bioc repos -> Bioconductor; and bioconductor.enabled = FALSE disabling inference and the lockfile entry.

All passing locally: snapshot, bioconductor, settings, lockfile, install, graph, retrieve, restore (0 failures).

Closes #2128.