don't upgrade transitive dependencies when installing with pak (#2329)

[kevinushey]

Fixes #2329.

Problem

renv::install() with pak enabled upgrades already-installed dependencies that are only pulled in transitively. Most visibly this affects recommended packages (e.g. cluster, Matrix) that ship with R: installing an unrelated package like clue would drag in cluster and, because renv forced upgrade = TRUE, pak would upgrade/rebuild it even though clue imposed no version constraint. In the reported case that rebuild then failed to compile locally.

The root cause is that renv_pak_install() passed upgrade = TRUE to pak::pkg_install(). pak's default is upgrade = FALSE, which does the minimum work to satisfy the request: it installs/upgrades the explicitly-requested packages to the latest version, but leaves already-installed dependencies alone unless a constraint requires a newer one. Forcing upgrade = TRUE overrode that and upgraded everything, diverging from renv's own native installer (renv_graph_needs_update), which leaves already-satisfied dependencies alone.

Fix

Pass upgrade = FALSE in renv_pak_install(), matching pak's default and renv's native installer.

To preserve the one useful property of upgrade = TRUE -- that an explicit request is always acted upon -- append the reinstall pak parameter to explicitly-requested packages. This mirrors renv's native installer, which always (re)installs explicitly-requested packages (renv_restore_find returns "" for anything in state$packages). Verified behaviors against pak 0.10.0:

• explicit request -> installed into the project library and taken to the latest version (and reinstalled even when already current);
• transitive dependency (including recommended packages) -> left at the installed version unless a dependency constraint requires an upgrade.

The query parameter is appended following pkgdepends' own model (everything after the first ? is an &-separated query), so a spec that already carries a query (e.g. bread?nocache) is extended with & rather than a malformed second ?.

The no-arg "update everything" path (renv_pak_update) is unchanged and still uses upgrade = TRUE.

Tests

Added to tests/testthat/test-pak.R:

• explicit requests are sent to pak as pkg?reinstall with upgrade = FALSE;
• a spec that already has a query gets &reinstall appended (not a second ?);
• a real (skip_if_not_installed) test that installing toast does not upgrade an already-installed, dependency-satisfying bread.

Full pak suite passes (37 passed, 0 failed, 0 skipped).