feat: extended IOC sources + archcanary features

Extended IOC sources (from archcanary):
- aur-audit.wtako.net black/red API (3rd-party continuous AUR scanner)
- Community reports list (community-curated malicious packages)
- CHAOS RAT campaign list (backdoor payload)
- Russian spam campaign list (.bashrc injection)

Client features (archcanary-inspired):
- Exit codes: 0=clean, 1=warning, 2=malicious (scriptable)
- --doctor health check (server, ollama, repo status)
- --scan-only mode (scan without building)
- IOC match display in malicious blocks
- Suspicious packages: interactive install prompt

All IOC fetches run concurrently for speed.

README.md

@@ -108,7 +108,7 @@ cache:
 
 ## Threat Intelligence Sources
 
-Based on [AegisAUR](https://gitea.die-heimatlosen.eu/arch_agent/aegisaur) IOC fetcher:
+Based on [AegisAUR](https://gitea.die-heimatlosen.eu/arch_agent/aegisaur) IOC fetcher + [archcanary](https://github.com/musqz/archcanary) extended sources:
 
 | Source | Type | Freshness | URL |
 |--------|------|-----------|-----|
@@ -116,6 +116,19 @@ Based on [AegisAUR](https://gitea.die-heimatlosen.eu/arch_agent/aegisaur) IOC fe
 | Atomic Arch Gist | GitHub Gist | Versioned | `gist.githubusercontent.com/Kidev/...` |
 | Arch Security | Official advisory | Slow but authoritative | `security.archlinux.org` |
 | AUR RPC | API | Real-time | `aur.archlinux.org/rpc/v5` |
+| aur-audit (black) | 3rd-party API | Continuous | `aur-audit.wtako.net/api/black` |
+| aur-audit (red) | 3rd-party API | Continuous | `aur-audit.wtako.net/api/red` |
+| Community Reports | Curated list | Manual | `github.com/musqz/archcanary` |
+| CHAOS RAT | Campaign list | Manual | `github.com/musqz/archcanary` |
+| Russian Spam | Campaign list | Manual | `github.com/musqz/archcanary` |
+
+## Exit Codes
+
+| Code | Meaning |
+|------|---------|
+| 0 | Clean — no indicators found |
+| 1 | Warning — suspicious, review recommended |
+| 2 | Malicious — package blocked |
 
 ## API