fix: address final-review findings before closing Plan 1

- privilege: wire sudo -v to real stdin/stdout/stderr so it can prompt
- cmd: validate --only/--skip IDs against registry (prevents silent
  run-all on typo); gate install to Arch-only (spec requirement);
  mark --only and --skip mutually exclusive
- platform: Pacman.Update now runs -Syu --noconfirm, not -Sy (avoids
  Arch partial-upgrade anti-pattern)
- test/integration: trap-clean the named docker volume on any exit
- go.mod: tidy — yaml.v3 is a direct dep

internal/platform/pacman.go

@@ -68,7 +68,10 @@ func (p Pacman) Install(ctx context.Context, pkgs []string) error {
 	return p.Runner.Run(ctx, "sudo", args...)
 }
 
-// Update runs `sudo pacman -Sy`.
+// Update runs `sudo pacman -Syu --noconfirm` (full sync + system upgrade).
+// On Arch, a bare `pacman -Sy` followed by an install is the partial-upgrade
+// anti-pattern that can break the system when a dep's ABI changes, so we
+// always pair the sync with the upgrade.
 func (p Pacman) Update(ctx context.Context) error {
-	return p.Runner.Run(ctx, "sudo", "pacman", "-Sy")
+	return p.Runner.Run(ctx, "sudo", "pacman", "-Syu", "--noconfirm")
 }

internal/platform/pacman_test.go

@@ -80,7 +80,7 @@ func TestPacmanUpdate(t *testing.T) {
 	if err := p.Update(context.Background()); err != nil {
 		t.Fatal(err)
 	}
-	want := []string{"sudo", "pacman", "-Sy"}
+	want := []string{"sudo", "pacman", "-Syu", "--noconfirm"}
 	if !reflect.DeepEqual(r.runCalls[0], want) {
 		t.Fatalf("args = %v, want %v", r.runCalls[0], want)
 	}