feat(build): inject the AUR repo into the profile and live ISO

Wire build-aur.sh into build.sh. After the pacoloco block, build the AUR repo and append a build-host [aur] stanza to profile/pacman.conf with an absolute file:// Server, so mkarchiso installs the baked packages into airootfs. The stanza lands after the pacoloco rewrite so its file:// path isn't redirected to localhost.

Add the audited official extra packages and the baked AUR names to packages.x86_64, both sourced from build-aur.sh so the list never drifts from the build array. Ship the repo into airootfs and write a complete live /etc/pacman.conf: the pristine releng config with [aur] appended, not an [aur]-only file, since this replaces the live system's stock config and an AUR-only one would strip the official repos. Copy the manifest beside the ISO in out/.

--skip-aur skips the build, the stanza, the AUR names, and the live config. The three injection points also guard on the repo dir existing, so the documented empty-set path can't point mkarchiso at a missing repo. Moved BUILD_LOG creation ahead of the AUR build so its output is captured too.

A unit test reproduces the live-config construction and asserts core, extra, the mirrorlist, and [aur] all survive. The end-to-end proof that mkarchiso installs from the build-host repo needs a real root build and is tracked as manual verification.

1 files changed, 20 insertions, 0 deletions

diff --git a/tests/unit/test_build_aur.bats b/tests/unit/test_build_aur.bats
index 06a78aa..4da66fe 100644
--- a/tests/unit/test_build_aur.bats
+++ b/tests/unit/test_build_aur.bats
@@ -82,6 +82,26 @@ setup() {
     [[ "$output" != *"/usr/share/aur-packages"* ]]
 }
 
+# Guards the reviewer's core concern: the live pacman.conf build.sh ships must
+# be a COMPLETE config (releng base + [aur] appended), not an [aur]-only file
+# that would strip the official repos from the live system. Reproduces the
+# build.sh construction (cp releng config, append the stanza) and asserts the
+# official repos, the mirrorlist Include, and [aur] all survive.
+@test "live pacman.conf base plus [aur] preserves core, extra, and the mirrorlist" {
+    local releng=/usr/share/archiso/configs/releng/pacman.conf
+    [ -f "$releng" ] || skip "releng pacman.conf not installed"
+    local f
+    f=$(mktemp)
+    cp "$releng" "$f"
+    aur_repo_stanza "file:///usr/share/aur-packages" >> "$f"
+    grep -q '^\[core\]' "$f"
+    grep -q '^\[extra\]' "$f"
+    grep -q '^\[aur\]' "$f"
+    grep -q '^Include = /etc/pacman.d/mirrorlist' "$f"
+    grep -q '^Server = file:///usr/share/aur-packages' "$f"
+    rm -f "$f"
+}
+
 #############################
 # aur_manifest_header / aur_manifest_row — TSV manifest formatting
 #############################