feat(aur): list and upgrade AUR packages through paru or yay on Arch

On the pacman backend, an installed AUR helper (paru, else yay;
--aur-helper=paru|yay|none, --no-aur) adds the AUR updates to the review
list. The helper never runs as root: when the tool is root through sudo it
runs as SUDO_USER (runuser -u, else sudo -u, with that user's HOME, from
that home); unprivileged it runs as is; a root login gets no AUR, with a
warning. The banner names the helper ("+ AUR via paru").

- listing: <helper> -Qua (also with --no-refresh), rows with repository
  "aur"; [ignored] is shown [held]; a failing -Qua warns and the session
  goes on with the repository rows
- every row has a marker column after the number: "*" for AUR rows, a
  space otherwise (on every backend)
- N?? merges pacman -Qi with <helper> -Sia; N?, N+, Nx stay with pacman;
  N- excludes through the helper's --ignore
- <enter>: the repository step exactly as before, then <helper> -Sua
  --ignore <excluded> as the invoking user (--noconfirm only when stdin is
  not a terminal); pacman is skipped when only AUR rows are left; a helper
  failure is reported and its status returned; --dry-run prints it
- other backends never run a helper; --aur-helper is ignored with a warning

paru 2.1.0 and yay 13.0.1 formats verified in discovery/pacman.md section
15 (proof: discovery/pacman/aur.sh). Unit tests replay the recorded output
(fake paru, yay, runuser, getent); the archlinux E2E run installs the
foreign su-dummy-aur and drives a fake paru through a fake sudo built on
passwordless su for wheel.

tests/unit/fakes/getent/getent

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-2.0-or-later
+# Copyright (C) 2026 Bryan Joshua Pedini
+
+# fake getent (unit tests): "getent passwd NAME" for alice (uid 1000, home $FAKE_DIR/home/alice),
+# root and toor (uid 0); exit 2 (no such key) for anyone else
+[[ ${1:-} == passwd ]] || exit 1
+case ${2:-} in
+alice) echo "alice:x:1000:1000:Alice:${FAKE_DIR:?}/home/alice:/bin/bash" ;;
+root) echo "root:x:0:0::/root:/bin/bash" ;;
+toor) echo "toor:x:0:0:root by another name:/root:/bin/bash" ;;
+*) exit 2 ;;
+esac

tests/unit/fakes/pacman/pacman

@@ -145,7 +145,7 @@ case $op in
 	fi
 	case $tg in
 	su-dummy-a) printf '%s\n' su-dummy-a su-dummy-b ;; # b was installed as a dependency of a
-	su-dummy-c | glib2 | expat | ca-certificates-mozilla) echo "$tg" ;;
+	su-dummy-c | glib2 | expat | ca-certificates-mozilla | pfetch | su-dummy-aur) echo "$tg" ;; # (the last two: foreign, AUR)
 	*)
 		echo "error: target not found: $tg" >&2
 		exit 1

tests/unit/fakes/paru/paru

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-2.0-or-later
+# Copyright (C) 2026 Bryan Joshua Pedini
+
+# fake paru (unit tests; fakes/yay/yay runs this file as yay): replays the output of paru 2.1.0
+# and yay 13.0.1 recorded in discovery/pacman.md section 15 (tests/unit/data/aur/) and logs every
+# call, followed by "<helper> as: HOME=... PWD=... stdin=tty|notty" (where and how it runs).
+# FAKE_AUR_QUA selects what -Qua prints: fixture (default: pfetch and su-dummy-aur), ignored
+# (pfetch in IgnorePkg: paru marks it [ignored], yay leaves it out), devel (a -git package whose
+# upstream moved: "-> latest-commit"), dup (an AUR row for su-dummy-b, which a repository has),
+# noise (yay's colored root warning on stdout), none (nothing to upgrade: exit 1, no output) or
+# fail (the AUR is unreachable: exit 1 with the recorded error). Packages purged by the fake pacman
+# are not listed. -Sia PKG prints data/aur/Sia-<helper>-PKG.txt (else the helper's not-found
+# error, exit 1), twice with FAKE_AUR_SIA=twice (a record that cannot be merged); -Sua exits
+# FAKE_AUR_SUA_RC (default 0).
+# shellcheck source=../fakelib.bash
+. "${BASH_SOURCE[0]%/*}/../fakelib.bash"
+fake_log "$@"
+if [[ -t 0 ]]; then stdin='tty'; else stdin='notty'; fi
+printf '%s as: HOME=%s PWD=%s stdin=%s\n' "$FAKE_NAME" "${HOME-}" "$PWD" "$stdin" >>"$FAKE_LOG"
+D=$FAKE_DATA/aur
+
+case ${1:-} in
+-Qua)
+	case ${FAKE_AUR_QUA:-fixture} in
+	none) exit 1 ;;
+	fail)
+		cat "$D/Qua-fail-$FAKE_NAME.err" >&2
+		exit 1
+		;;
+	esac
+	out=$(
+		while IFS= read -r line; do
+			fake_purged "${line%% *}" || printf '%s\n' "$line"
+		done <"$D/Qua-$FAKE_NAME-${FAKE_AUR_QUA:-fixture}.txt"
+	)
+	[[ -n $out ]] || exit 1
+	printf '%s\n' "$out"
+	;;
+-Sia)
+	if [[ -f $D/Sia-$FAKE_NAME-${2:-}.txt ]]; then
+		cat "$D/Sia-$FAKE_NAME-$2.txt"
+		[[ ${FAKE_AUR_SIA:-} != twice ]] || cat "$D/Sia-$FAKE_NAME-$2.txt"
+		exit 0
+	fi
+	if [[ $FAKE_NAME == yay ]]; then
+		echo " -> No AUR package found for ${2:-}" >&2
+	else
+		echo "error: package '${2:-}' was not found" >&2
+	fi
+	exit 1
+	;;
+-Sua) exit "$(fake_rc FAKE_AUR_SUA_RC 0)" ;;
+*)
+	echo "fake $FAKE_NAME: unhandled: $*" >&2
+	exit 99
+	;;
+esac

tests/unit/fakes/runuser/runuser

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-2.0-or-later
+# Copyright (C) 2026 Bryan Joshua Pedini
+
+# fake runuser (unit tests): logs "runuser -u USER -- CMD..." and runs CMD (as the same user)
+# shellcheck source=../fakelib.bash
+. "${BASH_SOURCE[0]%/*}/../fakelib.bash"
+fake_log "$@"
+if [[ ${1:-} != -u || ${3:-} != -- ]]; then
+	echo "fake runuser: unexpected arguments: $*" >&2
+	exit 98
+fi
+shift 3
+exec "$@"

tests/unit/fakes/sudo/sudo

@@ -2,8 +2,13 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 # Copyright (C) 2026 Bryan Joshua Pedini
 
-# fake sudo (unit tests): logs the command it was asked to run, runs nothing
+# fake sudo (unit tests): logs the command it was asked to run; runs nothing (the re-exec of the
+# applet), except "sudo -u USER -- CMD...", which runs CMD (as the same user: an AUR helper)
 # shellcheck source=../fakelib.bash
 . "${BASH_SOURCE[0]%/*}/../fakelib.bash"
 fake_log "$@"
+if [[ ${1:-} == -u && ${3:-} == -- ]]; then
+	shift 3
+	exec "$@"
+fi
 exit 0

tests/unit/fakes/yay/yay

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-2.0-or-later
+# Copyright (C) 2026 Bryan Joshua Pedini
+
+# fake yay (unit tests): the fake paru, replaying yay's recorded output instead
+FAKE_AS=yay exec "${BASH_SOURCE[0]%/*}/../paru/paru" "$@"