[workr] Switch manifest.yaml from source()-ing files to installing the package

[zdz2101]

Summary

Switch .github/workflows/manifest.yaml in workr from sparse-checking-out R sources and source()-ing every R/*.R file to installing the package via R CMD INSTALL (or pak::pkg_install) and library(workr).

Problem / Rationale

• source()-ing bypasses the package NAMESPACE — anything relying on @importFrom declarations works only by accident.
• Sparse-checkout pinned to @dev means a force-push silently changes what runs in every caller. A release tag won't help downstream until the workflow consumes it via install.
• Installing the package lets the workflow run identically against a local checkout or a tagged release.

Scope

In scope: Rewrite the Checkout workr R sources + Install R dependencies + Create manifest steps in workr/.github/workflows/manifest.yaml to install the package and library(workr) instead of source-the-files; verify nightly-manifest.yaml still runs green against ss-demo.
Out of scope: The v1.1 release (#44) — this can land first against @main via install, then #44 bumps to a tag.

Proposed Approach

1. Drop the Checkout workr R sources step (or keep without sparse-checkout: R and use as install source).
2. Replace Install R dependencies + Create manifest with a step that does R CMD INSTALL _workr (or pak::pkg_install), then library(workr); workr::pkgManifest(...).
3. Trigger nightly-manifest.yaml; confirm outputs unchanged from pre-refactor source() run on the same SHA.

QC Approach

• Unit Tests (suite from [workr] Add testthat coverage for pull_workflows and resolve_package #43 exercises the now-package-loaded functions)
• User Tests (nightly-manifest.yaml runs green; artifacts byte-equal to a source()-based run on the same SHA)

Related

Part of the gismo.library snapshot pipeline requirement: Gilead-BioStats/gsm.roadmap#20 (Theme A)