feat(aur): list and upgrade AUR packages through paru or yay on Arch

On the pacman backend, an installed AUR helper (paru, else yay;
--aur-helper=paru|yay|none, --no-aur) adds the AUR updates to the review
list. The helper never runs as root: when the tool is root through sudo it
runs as SUDO_USER (runuser -u, else sudo -u, with that user's HOME, from
that home); unprivileged it runs as is; a root login gets no AUR, with a
warning. The banner names the helper ("+ AUR via paru").

- listing: <helper> -Qua (also with --no-refresh), rows with repository
  "aur"; [ignored] is shown [held]; a failing -Qua warns and the session
  goes on with the repository rows
- every row has a marker column after the number: "*" for AUR rows, a
  space otherwise (on every backend)
- N?? merges pacman -Qi with <helper> -Sia; N?, N+, Nx stay with pacman;
  N- excludes through the helper's --ignore
- <enter>: the repository step exactly as before, then <helper> -Sua
  --ignore <excluded> as the invoking user (--noconfirm only when stdin is
  not a terminal); pacman is skipped when only AUR rows are left; a helper
  failure is reported and its status returned; --dry-run prints it
- other backends never run a helper; --aur-helper is ignored with a warning

paru 2.1.0 and yay 13.0.1 formats verified in discovery/pacman.md section
15 (proof: discovery/pacman/aur.sh). Unit tests replay the recorded output
(fake paru, yay, runuser, getent); the archlinux E2E run installs the
foreign su-dummy-aur and drives a fake paru through a fake sudo built on
passwordless su for wheel.

tests/e2e/fixtures/fake-sudo.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-2.0-or-later
+# Copyright (C) 2026 Bryan Joshua Pedini
+
+# Fake sudo for the AUR E2E tests (tests/e2e/aur.bats installs it as /usr/local/bin/sudo on the
+# pacman backend): archlinux:latest has no sudo and the E2E run is offline. Runs
+# "sudo [--] COMMAND..." as root through su, which the fixture (FIXTURE_AUR=1) makes passwordless
+# for the members of wheel (pam_wheel trust), with the variables sudo sets for the command:
+# SUDO_USER, SUDO_UID and SUDO_GID. Used for the applet's own re-exec and by the fake paru.
+[[ ${1:-} != -- ]] || shift
+if (($# == 0)); then
+	echo "usage: sudo [--] command..." >&2
+	exit 1
+fi
+# shellcheck disable=SC2016 # $1... belong to the root shell started by su
+exec su -s /bin/bash root -c 'exec env SUDO_USER="$1" SUDO_UID="$2" SUDO_GID="$3" "${@:4}"' -- sudo "$(id -un)" "$(id -u)" "$(id -g)" "$@"