Sync+upgrade before installing to avoid stale-package-database 404s

Live test hit a real Arch gotcha: a package build referenced by a stale
local package database had already rotated off every mirror, 404ing on
install. Fix is pacman -Syu before the targeted install -- never a bare -Sy
without -u, which risks an unsupported partial upgrade. Also added
--noconfirm to both pacman calls now that confirm_summary() already gates
the whole run on an explicit yes.

install.sh

@@ -223,10 +223,18 @@ apply() {
     backup_if_exists "$LOCAL_BIN/screenshot.sh"
     backup_if_exists "$LOCAL_BIN/toggle-recording.sh"
 
+    # Sync + upgrade first. Without this, a local package database that's
+    # drifted from the mirrors can reference a package build that's already
+    # been rotated off every mirror (404 on install), and a bare `-Sy`
+    # without `-u` risks a partial upgrade -- unsupported on Arch and can
+    # break dependencies. `-Syu` is the only safe way to bring the database
+    # in sync before installing anything new.
+    sudo pacman -Syu --noconfirm
+
     local pkg_list
     pkg_list="$(build_package_list)"
     # shellcheck disable=SC2086
-    sudo pacman -S --needed $pkg_list
+    sudo pacman -S --needed --noconfirm $pkg_list
 
     mkdir -p "$CONFIG_HOME/hypr"
     render_hyprland_conf "$REPO_DIR/hypr/hyprland.conf" > "$CONFIG_HOME/hypr/hyprland.conf"

tests/install.bats

@@ -290,7 +290,10 @@ EOF
     # Capture scripts were copied and made executable since ScreenCapture was picked.
     [ -x "$LOCAL_BIN/capture-menu.sh" ]
 
-    # pacman was invoked once with --needed.
+    # pacman was synced/upgraded first (avoids installing against a stale
+    # local package database that no longer matches the mirrors), then the
+    # actual package list was installed with --needed.
+    grep -q '\-Syu' "$HYPREVO_TEST_LOG"
     grep -q '\-\-needed' "$HYPREVO_TEST_LOG"
 
     # Syncthing's systemd user service was enabled, since CloudSync=Syncthing.