Install remotes and bump the later pin so modules can build

Two more failures, both found by the guards added in the previous commit
rather than by shipping a broken package:

- install_github() has been deprecated since devtools 2.5.0 and now
  delegates to the 'remotes' package, which is no longer a hard dependency
  of devtools. jaspModuleTools could therefore never install, regardless of
  GitHub tokens - my earlier diagnosis of a rate limit was wrong. remotes is
  now pre-seeded into the library the script sets via .libPaths().

- later 1.4.6, pinned in every module renv.lock, bundles a tinycthread whose
  '#define once_flag pthread_once_t' collides with the C11 once_flag that
  glibc >= 2.43 declares under C23. Fixed upstream in later 1.4.7
  (r-lib/later#257); the 2026-04-22 RSPM snapshot the lockfiles already
  point at carries 1.4.8.

The lockfile patch is deliberately an explicit per-package list with a
recorded reason, not a blanket 'use latest' - silently changing the analysis
packages users get would be worse than a build failure.

build/build-jasp.sh

@@ -52,7 +52,7 @@ pacman -Syu --noconfirm --needed \
   boost boost-libs glpk jsoncpp libarchive openssl curl sqlite zlib \
   readstat netcdf mpfr cairo pango fontconfig harfbuzz fribidi icu pcre2 \
   readline bzip2 xz libpng libtiff libjpeg-turbo minizip \
-  libxkbcommon libxkbcommon-x11 libxt wget unzip
+  libxkbcommon libxkbcommon-x11 libxt wget unzip python
 
 # Stock makepkg.conf leaves MAKEFLAGS at -j1, which makes the AUR dependencies
 # (JAGS especially) crawl.
@@ -195,14 +195,68 @@ export GITHUB_TOKEN="${GITHUB_PAT}"
 log "building R modules — this is the slow part"
 mkdir -p "$BUILD_DIR"/Modules/{binary_pkgs,manifests,module_libs,Tools}
 cd "$SRC_DIR/Tools"
-Rscript buildAllDefaultJaspModules.R
 
+# buildModuleBundlesLocally.R calls devtools::install_github(), which since
+# devtools 2.5.0 is deprecated and delegates to the `remotes` package — but
+# remotes is no longer a hard dependency of devtools, so the call dies with
+# "The package \"remotes\" is required." Pre-seed it into the same library the
+# script uses, since that script does .libPaths(new=userLibrary) and would not
+# see remotes anywhere else.
 MODULE_LIBRARY="$SRC_DIR/Tools/ModuleBundleBuildDir/LibraryR"
 MODULE_BUNDLES="$SRC_DIR/Modules/local"
 
+log "pre-installing remotes into the module build library"
+mkdir -p "$MODULE_LIBRARY"
+Rscript -e "
+  lib <- '${MODULE_LIBRARY}'
+  .libPaths(new = lib)
+  install.packages('remotes', lib = lib, repos = 'https://cran.r-project.org')
+  if (!requireNamespace('remotes', lib.loc = lib, quietly = TRUE))
+    stop('failed to install remotes')
+"
+
+# Some of the versions JASP pins in its module renv.lock files predate the
+# toolchain on a current Arch and cannot compile. Bump only those, by name, with
+# the reason recorded — never a blanket "use latest", which would silently
+# change the analysis code users get.
+#
+#   later  1.4.6 bundles a tinycthread whose `#define once_flag pthread_once_t`
+#          collides with the C11 once_flag that glibc >= 2.43 now declares under
+#          C23, so it fails with "conflicting types for pthread_once_t".
+#          Fixed upstream in later 1.4.7 (r-lib/later#257). The 2026-04-22 RSPM
+#          snapshot the lockfiles already reference carries 1.4.8.
+log "patching module lockfile pins that cannot build on this toolchain"
+python3 - <<'PY'
+import json, pathlib
+
+OVERRIDES = {"later": "1.4.8"}
+
+root = pathlib.Path("ModuleBundleBuildDir/Modules")
+patched = 0
+for lock in root.glob("*/renv.lock"):
+    data = json.loads(lock.read_text())
+    packages = data.get("Packages", {})
+    changed = False
+    for name, want in OVERRIDES.items():
+        pkg = packages.get(name)
+        if pkg and pkg.get("Version") != want:
+            print(f"  {lock.parent.name}: {name} {pkg['Version']} -> {want}")
+            pkg["Version"] = want
+            # The recorded hash no longer matches the bumped version.
+            pkg.pop("Hash", None)
+            changed = True
+    if changed:
+        lock.write_text(json.dumps(data, indent=2) + "\n")
+        patched += 1
+print(f"patched {patched} lockfiles")
+PY
+
+Rscript buildAllDefaultJaspModules.R
+
 if [[ ! -d "$MODULE_LIBRARY/jaspModuleTools" ]]; then
   echo "error: jaspModuleTools was not installed — install_github failed" >&2
-  echo "       (GitHub rate limit, or GITHUB_PAT lacks read access)" >&2
+  echo "       check the install_github output above: a missing 'remotes'," >&2
+  echo "       a GitHub rate limit, or a PAT without read access all do this" >&2
   exit 1
 fi