feat(aur): list and upgrade AUR packages through paru or yay on Arch

On the pacman backend, an installed AUR helper (paru, else yay;
--aur-helper=paru|yay|none, --no-aur) adds the AUR updates to the review
list. The helper never runs as root: when the tool is root through sudo it
runs as SUDO_USER (runuser -u, else sudo -u, with that user's HOME, from
that home); unprivileged it runs as is; a root login gets no AUR, with a
warning. The banner names the helper ("+ AUR via paru").

- listing: <helper> -Qua (also with --no-refresh), rows with repository
  "aur"; [ignored] is shown [held]; a failing -Qua warns and the session
  goes on with the repository rows
- every row has a marker column after the number: "*" for AUR rows, a
  space otherwise (on every backend)
- N?? merges pacman -Qi with <helper> -Sia; N?, N+, Nx stay with pacman;
  N- excludes through the helper's --ignore
- <enter>: the repository step exactly as before, then <helper> -Sua
  --ignore <excluded> as the invoking user (--noconfirm only when stdin is
  not a terminal); pacman is skipped when only AUR rows are left; a helper
  failure is reported and its status returned; --dry-run prints it
- other backends never run a helper; --aur-helper is ignored with a warning

paru 2.1.0 and yay 13.0.1 formats verified in discovery/pacman.md section
15 (proof: discovery/pacman/aur.sh). Unit tests replay the recorded output
(fake paru, yay, runuser, getent); the archlinux E2E run installs the
foreign su-dummy-aur and drives a fake paru through a fake sudo built on
passwordless su for wheel.

tests/e2e/fixtures/pacman.sh

@@ -3,8 +3,9 @@
 # Copyright (C) 2026 Bryan Joshua Pedini
 
 # Deterministic pacman fixture for skeptical-updater E2E tests.
-# (tests/e2e/fixtures/pacman.sh: copy of discovery/pacman/fixture.sh plus the FIXTURE_ORPHAN
-#  knob; tests/e2e/entrypoint.sh runs it with FIXTURE_ISOLATE=1 FIXTURE_ORPHAN=1.)
+# (tests/e2e/fixtures/pacman.sh: copy of discovery/pacman/fixture.sh plus the FIXTURE_ORPHAN and
+#  FIXTURE_AUR knobs; tests/e2e/entrypoint.sh runs it with FIXTURE_ISOLATE=1 FIXTURE_ORPHAN=1
+#  FIXTURE_SYNC=1 FIXTURE_AUR=1.)
 #
 # Creates three dummy packages installed at 1.0 and a local pacman repo
 # ([su-dummy], file:///srv/su-repo) that offers them at 2.0:
@@ -37,6 +38,11 @@
 #       IgnorePkg) while upgrading su-dummy-a fails with unsatisfied deps.
 #   FIXTURE_ORPHAN   0 (default) | 1  -> also install su-dummy-orphan 1.0 --asdeps with nothing
 #                    requiring it (a pre-existing orphan, `pacman -Qdtq` lists it)
+#   FIXTURE_AUR      0 (default) | 1  -> also install su-dummy-aur 1.0, a foreign package (in no
+#                    repository: `pacman -Qm` lists it), and keep its 2.0 package file in
+#                    /srv/su-aur for the fake paru of tests/e2e/aur.bats; create the user
+#                    su-tester (group wheel) and make `su` passwordless for wheel (pam_wheel
+#                    trust), which the fake sudo of those tests relies on (the image has no sudo)
 #   FIXTURE_REPO     repo directory (default /srv/su-repo)
 #   FIXTURE_SYNC     0 (default) | 1  -> run `pacman -Sy` at the end
 #
@@ -52,6 +58,7 @@ FIXTURE_STRICT_DEP=${FIXTURE_STRICT_DEP:-0}
 FIXTURE_REPO=${FIXTURE_REPO:-/srv/su-repo}
 FIXTURE_SYNC=${FIXTURE_SYNC:-0}
 FIXTURE_ORPHAN=${FIXTURE_ORPHAN:-0}
+FIXTURE_AUR=${FIXTURE_AUR:-0}
 FIXTURE_REPO_NAME=su-dummy
 FIXTURE_EPOCH=1700000000   # fixed build date => reproducible tarballs
 
@@ -208,7 +215,24 @@ fx_main() {
   fi
   rm -rf "$old"
 
+  if [ "$FIXTURE_AUR" = 1 ]; then
+    mkdir -p /srv/su-aur
+    [ "$FIXTURE_BUILDER" != makepkg ] || chown su-builder: /srv/su-aur
+    fx_build /srv/su-aur su-dummy-aur 1.0 'Skeptical-updater dummy package AUR (foreign: in no repository)'
+    fx_build /srv/su-aur su-dummy-aur 2.0 'Skeptical-updater dummy package AUR (foreign: in no repository)'
+    chmod -R a+rX /srv/su-aur
+    fx_pacman -U --noconfirm /srv/su-aur/su-dummy-aur-1.0-1-any.pkg.tar.zst
+    id su-tester >/dev/null 2>&1 || useradd --create-home --groups wheel su-tester
+    sed -i 's/^#\(auth[[:space:]]\+sufficient[[:space:]]\+pam_wheel\.so trust use_uid\)/\1/' /etc/pam.d/su
+    grep -q '^auth[[:space:]]\+sufficient[[:space:]]\+pam_wheel\.so trust use_uid' /etc/pam.d/su ||
+      fx_die "could not enable pam_wheel trust in /etc/pam.d/su"
+  fi
+
   if [ "$FIXTURE_SYNC" = 1 ]; then fx_pacman -Sy; fi
+  if [ "$FIXTURE_AUR" = 1 ]; then
+    pacman -Qmq | grep -qx su-dummy-aur || fx_die "su-dummy-aur is not a foreign package"
+    fx_log "foreign (AUR) package: su-dummy-aur 1.0; user su-tester (wheel, passwordless su)"
+  fi
 
   fx_log "builder=$FIXTURE_BUILDER isolate=$FIXTURE_ISOLATE repo=$FIXTURE_REPO"
   fx_log "installed: $(pacman -Q su-dummy-a su-dummy-b su-dummy-c 2>/dev/null | tr '\n' ';')"