fix: address final-review findings before closing Plan 1

- privilege: wire sudo -v to real stdin/stdout/stderr so it can prompt
- cmd: validate --only/--skip IDs against registry (prevents silent
  run-all on typo); gate install to Arch-only (spec requirement);
  mark --only and --skip mutually exclusive
- platform: Pacman.Update now runs -Syu --noconfirm, not -Sy (avoids
  Arch partial-upgrade anti-pattern)
- test/integration: trap-clean the named docker volume on any exit
- go.mod: tidy — yaml.v3 is a direct dep

test/integration/run.sh

@@ -14,8 +14,10 @@ echo "--- run 1: fresh install"
 docker run --rm "$IMAGE" install --no-tui --no-sudo
 
 echo "--- run 2: idempotent (marker already present)"
-# Persist home across runs via a named volume.
+# Persist home across runs via a named volume. Clean up on any exit so a
+# failed assertion doesn't leak the volume to the next run.
 VOL=archduino-integration-home
+trap 'docker volume rm "$VOL" >/dev/null 2>&1 || true' EXIT
 docker volume create "$VOL" >/dev/null
 docker run --rm -v "$VOL":/home/tester "$IMAGE" install --no-tui --no-sudo
 docker run --rm -v "$VOL":/home/tester "$IMAGE" install --no-tui --no-sudo
@@ -23,5 +25,4 @@ docker run --rm -v "$VOL":/home/tester "$IMAGE" install --no-tui --no-sudo
 echo "--- assert marker exists in volume"
 docker run --rm -v "$VOL":/home/tester --entrypoint test "$IMAGE" -f /home/tester/.cache/archduino/hello.ok
 
-docker volume rm "$VOL" >/dev/null
 echo "--- integration test PASSED"