Port the allocation and scoring core

[nickreich]

The hub-agnostic core: the budget-constrained optimizer and the score built on
it.

Stacked on #1 — this PR targets nr/scaffolding/1, so the diff shows only
this layer. GitHub will retarget it to main automatically once #1 merges.

What it does

allocate() solves

min_x  sum_i E_{Y_i ~ F_i} L_i(x_i, Y_i)   s.t.  sum_i w_i x_i <= K,  x_i >= 0

where each L_i is a generalized piecewise linear (pinball) loss. The problem
is separable and convex, so at the optimum every target receiving a positive
allocation has the same marginal expected benefit. allocate() bisects on that
common value — the shadow price of the budget — which makes each allocation a
predictive quantile discounted by that price. All values of K are solved
simultaneously, sharing root-finding work wherever they currently agree on the
multiplier.

alloscore() then charges the realized loss of that allocation against the loss
of an oracle that knew the outcomes, so a perfect forecast scores zero.

Verification

The original package had exactly one test, the usethis placeholder
expect_equal(2 * 2, 4). This PR adds 306.

• Unit tests for every exported function, including closed-form checks of
  the expected losses against the analytic normal formulae, finite-difference
  checks of their derivatives, and a check that the unconstrained optimum is the
  alpha-quantile.
• test-zxh.R reproduces published optima. The zxh_tab2 and zxh_tab3
  datasets carry the optimal solutions to two budget-constrained multiproduct
  newsboy problems from Zhang, Xu and Hua (2009) in their Opt column, so this
  is ground truth external to both versions of the package. allocate()
  reproduces Table 2 to within 0.06 of a unit and picks out exactly the 6 of 17
  products that ZXH stock. data-raw/zxh.R transcribes both tables and
  reproduces the original .rda files exactly.

Before writing any of it I compared each ported function against the original
directly: every loss function, pdqr builder and allocate() path is
bit-identical (max|diff| = 0), including the negative-kappa case the
optimizer relies on, the distfromq path, and the g = log(x) / alpha = 1
special case. PR 4 freezes that into CI fixtures.

Bug fixes

Listed in NEWS.md. The substantive ones: the O/U cost parameterization
errored or silently returned NULL; dg and exp_gpl_loss_fun()'s offset
were accepted and ignored; new_gpl_df() referred to an undefined variable;
alloscore.slim() ignored against_oracle; allocate() returned an unusable
object when no target had any marginal benefit; and every dplyr and tidyr call
is now namespaced and declared, where the original only worked with the
tidyverse attached.

Known limitations, filed rather than fixed

Three pre-existing behaviours are pinned by tests rather than changed, so that
altering them has to be deliberate: #3 (negative allocations when the
alpha-quantile is negative), #4 (the oracle spends the whole budget even when
it has no use for it) and #5 (g = "log(x)" cannot be bracketed). #1 and #2 are
also visible from this layer.

Verified locally

R CMD check: Status: OK. 306 tests, 0 failures, 0 warnings, 0 skips.
lintr: 0 lints. air format . --check: clean.

[nickreich]

Same cause as #6. Replaced by #9.