`rv add` with an invalid package still commits it to `rproject.toml`

[andriygm]

When adding an invalid package using rv add, the package predictably fails:

❯ rv add invalid-package
Failed to resolve all dependencies
    invalid-package [listed in rproject.toml]

but the rproject.toml still gets updated with the invalid package:

dependencies = ["knitr", "rmarkdown", "ggplot2", "dygraphs",
+++    "invalid-package",
]

[Keats]

I think it's fine as a behaviour?

[andriygm]

this creates a desync between the reported and installed packages, which I think is not ideal. following this, if the user tries to rv sync, it will fail since one or more of the packages will not resolve. I think most package managers handle it this way. I can't personally think of a case where a user would actually want the package added to the dependencies array unless the package just hasn't been published yet / user does not have access yet. In this case, maybe the user should supply --force or similar to add it acknowledging this (or they can always manually edit).

for example with uv, they can supply --frozen to skip lock/sync to add it anyways:

❯ uv add invalidpackagefiodqjx1
Using CPython 3.12.8
Creating virtual environment at: .venv
  × No solution found when resolving dependencies:
  ╰─▶ Because invalidpackagefiodqjx1 was not found in the package registry and your project depends on
      invalidpackagefiodqjx1, we can conclude that your project's requirements are unsatisfiable.
  help: If you want to add the package regardless of the failed resolution, provide the `--frozen` flag to
        skip locking and syncing.

[weswc]

I actually had something similar to this in a PR way back. Here was Devin's feedback.

The two parts that convinced me were:

• We have --dry-run, so if you're not sure if a package is there or not, you should use that to see if we can resolve the new package
• R (and the way we wrote rv) is inherently different than python in that there are many places the packages are coming from. In uv, that's a bit more "locked" and adding a new repository/source is far less common. Most of the time in R, the issue is not actually the package being added, but its that you don't have the proper repository for that package to come from

[andriygm]

it's a good point, especially if most of the time it is indeed access/repo related versus a typo, it does still make sense to add. maybe it's the presentation that's a little confusing -- it might be worth indicating to the user in two separate stages e.g.:

Added 1 package to the project in 10ms
- `invalid-package`

Resolving packages...
WARN/ERR: One or more of the packages failed to resolve. Check your respository configuration and ensure you have appropriate access to all of the specified packages.

which successfully communicates that one thing did happen successfully and the other failed.