fix: complete 0.3.0 Pacsea prerequisites

[Firstp1ck]

Summary

• Bound AUR info, comments, PKGBUILD, and .SRCINFO responses to 10 MiB.
• Harden package operands and missing-helper fallback behavior.
• Add the exact Pacsea feature contract, CI coverage, and lean crates.io packaging.
• Update 0.3 documentation and release evidence.

Validation

• Formatting, Clippy, MSRV, docs, audit, complexity, and all test matrices pass.
• Clean cargo package --list and cargo publish --dry-run pass.

No tag, release, or crates.io publication is included.

[Copilot]

Pull request overview

This PR finalizes arch-toolkit’s 0.3.0 “Pacsea prerequisite” hardening by adding a shared bounded HTTP response reader, tightening install command operand safety (validation + -- terminator + missing-helper failure behavior), and codifying the Pacsea feature/contract and CI coverage, along with packaging/docs updates.

Changes:

• Add a shared streamed response reader with a strict 10 MiB ceiling + UTF-8 validation and adopt it for AUR info/comments/PKGBUILD and .SRCINFO.
• Harden install/remove command construction with stricter package-name validation, always placing -- before operands, and making the no-AUR-helper fallback fail with stderr + exit 127.
• Add/extend compatibility & integration contract tests, CI matrix coverage for the Pacsea feature projection, and crates.io include packaging allowlist.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/install_integration.rs	Adds regression tests for operand terminators, safe-name rules, and shell-fallback helper selection/error behavior.
tests/compatibility_contract.rs	Extends compatibility contract coverage for Pacsea feature projection + model fixtures.
src/lib.rs	Wires in the new internal http module under feature = "aur".
src/install/shell.rs	Tightens is_safe_package_name (leading-byte rule) and updates validation error pattern text/tests.
src/install/mod.rs	Updates install-module docs/examples for the new -- operand terminator.
src/install/command.rs	Adds -- operand terminator to install/remove builders and makes AUR shell fallback fail loudly (stderr + exit 127).
src/install/batch.rs	Updates batch-plan docs/tests and ensures batched commands inherit name validation + operand terminator.
src/http.rs	Introduces shared bounded response reader with extensive unit tests for size/stream/UTF-8 edge cases.
src/deps/srcinfo.rs	Applies bounded response reading + contextual errors to AUR .SRCINFO fetch; adds fixture tests.
src/aur/pkgbuild.rs	Applies bounded response reading to PKGBUILD fetch; adds fixture tests.
src/aur/info.rs	Bounds AUR info response text before JSON parse; makes malformed JSON return contextual Parse; adds fixture tests.
src/aur/comments.rs	Bounds comments HTML response before parsing; improves selector parse errors; adds fixture tests.
reports/pacsea-v0-3-0-upstream-prerequisites.html	Adds an implementation/verification report artifact for the 0.3.0 prerequisite work.
README.md	Updates dependency snippets to 0.3 and reflects -- in install/remove output examples.
CHANGELOG.md	Documents the 0.3.0 compatibility projection and the behavioral deltas (bounds, terminator, exit 127, parse errors).
Cargo.toml	Adds an explicit crates.io include allowlist for a leaner package payload.
.github/workflows/rust.yml	Adds CI row + dependency isolation check for the Pacsea feature projection.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.