feat(aur): list and upgrade AUR packages through paru or yay on Arch

On the pacman backend, an installed AUR helper (paru, else yay;
--aur-helper=paru|yay|none, --no-aur) adds the AUR updates to the review
list. The helper never runs as root: when the tool is root through sudo it
runs as SUDO_USER (runuser -u, else sudo -u, with that user's HOME, from
that home); unprivileged it runs as is; a root login gets no AUR, with a
warning. The banner names the helper ("+ AUR via paru").

- listing: <helper> -Qua (also with --no-refresh), rows with repository
  "aur"; [ignored] is shown [held]; a failing -Qua warns and the session
  goes on with the repository rows
- every row has a marker column after the number: "*" for AUR rows, a
  space otherwise (on every backend)
- N?? merges pacman -Qi with <helper> -Sia; N?, N+, Nx stay with pacman;
  N- excludes through the helper's --ignore
- <enter>: the repository step exactly as before, then <helper> -Sua
  --ignore <excluded> as the invoking user (--noconfirm only when stdin is
  not a terminal); pacman is skipped when only AUR rows are left; a helper
  failure is reported and its status returned; --dry-run prints it
- other backends never run a helper; --aur-helper is ignored with a warning

paru 2.1.0 and yay 13.0.1 formats verified in discovery/pacman.md section
15 (proof: discovery/pacman/aur.sh). Unit tests replay the recorded output
(fake paru, yay, runuser, getent); the archlinux E2E run installs the
foreign su-dummy-aur and drives a fake paru through a fake sudo built on
passwordless su for wheel.

tests/e2e/skeptical-updater.bats

@@ -26,9 +26,9 @@ zypper_verb() { case $(. /etc/os-release && printf '%s' "$ID") in opensuse-tumbl
 	run skeptical-updater list --no-refresh
 	assert_success
 	assert_line "3 upgradable, 0 trusted (hidden, use --all to show), 3 to review:"
-	assert_line --regexp '^ \[1\] su-dummy-a +1\.0(-1)? +-> +2\.0(-1)? +[^ ]+$'
-	assert_line --regexp '^ \[2\] su-dummy-b +1\.0(-1)? +-> +2\.0(-1)? +[^ ]+$'
-	assert_line --regexp '^ \[3\] su-dummy-c +1\.0(-1)? +-> +2\.0(-1)? +[^ ]+$'
+	assert_line --regexp '^ \[1\]  su-dummy-a +1\.0(-1)? +-> +2\.0(-1)? +[^ ]+$'
+	assert_line --regexp '^ \[2\]  su-dummy-b +1\.0(-1)? +-> +2\.0(-1)? +[^ ]+$'
+	assert_line --regexp '^ \[3\]  su-dummy-c +1\.0(-1)? +-> +2\.0(-1)? +[^ ]+$'
 	refute_line --regexp '^.\[4\]'
 }
 
@@ -100,13 +100,13 @@ zypper_verb() { case $(. /etc/os-release && printf '%s' "$ID") in opensuse-tumbl
 	assert_line "3 upgradable, 2 trusted (hidden, use --all to show), 1 to review:"
 	refute_output --partial 'su-dummy-a'
 	refute_output --partial 'su-dummy-b'
-	assert_line --regexp '^ \[1\] su-dummy-c '
+	assert_line --regexp '^ \[1\]  su-dummy-c '
 	run skeptical-updater list --no-refresh --all
 	assert_success
 	assert_line "3 upgradable, 2 trusted (marked with =), 1 to review:"
-	assert_line --regexp '^=\[1\] su-dummy-a '
-	assert_line --regexp '^=\[2\] su-dummy-b '
-	assert_line --regexp '^ \[3\] su-dummy-c '
+	assert_line --regexp '^=\[1\]  su-dummy-a '
+	assert_line --regexp '^=\[2\]  su-dummy-b '
+	assert_line --regexp '^ \[3\]  su-dummy-c '
 }
 
 @test "trust / trusted / refresh / untrust from the command line" {
@@ -142,7 +142,7 @@ zypper_verb() { case $(. /etc/os-release && printf '%s' "$ID") in opensuse-tumbl
 	[[ $(versions) == "a=2.0 b=1.0 c=2.0" ]] || fail "versions after the run: $(versions)"
 	[[ $(holds_snapshot) == "$before" ]] || fail "hold/lock state changed: $(holds_snapshot)"
 	run skeptical-updater list --no-refresh
-	assert_line --regexp '^ \[1\] su-dummy-b +1\.0'
+	assert_line --regexp '^ \[1\]  su-dummy-b +1\.0'
 }
 
 @test "a pre-existing hold/lock/IgnorePkg on su-dummy-c survives a run that excludes su-dummy-b" {
@@ -150,7 +150,7 @@ zypper_verb() { case $(. /etc/os-release && printf '%s' "$ID") in opensuse-tumbl
 	before=$(holds_snapshot)
 	[[ -n $before ]]
 	run skeptical-updater list --no-refresh
-	assert_line --regexp '^ \[2\] su-dummy-b '
+	assert_line --regexp '^ \[2\]  su-dummy-b '
 	run skeptical-updater <<<$'2-\n'
 	assert_success
 	assert_line 'Excluded from this run: su-dummy-b'
@@ -193,7 +193,7 @@ zypper_verb() { case $(. /etc/os-release && printf '%s' "$ID") in opensuse-tumbl
 	assert_success
 	assert_line 'not purged: su-dummy-b is required by: su-dummy-a - purge the dependents first'
 	refute_output --partial '[y/N]'
-	[[ $(grep -c '^ \[2\] su-dummy-b ' <<<"$output") -eq 2 ]] || fail "row 2 left the list"
+	[[ $(grep -c '^ \[2\]  su-dummy-b ' <<<"$output") -eq 2 ]] || fail "row 2 left the list"
 	[[ $(versions) == "a=1.0 b=1.0 c=1.0" ]] || fail "versions after the run: $(versions)"
 }