Auditing an Arch endpoint after a suspicious AUR install

An evidence-first endpoint review for package identity, script execution, containment, and recovery.