feat: extended IOC sources + archcanary features

Extended IOC sources (from archcanary):
- aur-audit.wtako.net black/red API (3rd-party continuous AUR scanner)
- Community reports list (community-curated malicious packages)
- CHAOS RAT campaign list (backdoor payload)
- Russian spam campaign list (.bashrc injection)

Client features (archcanary-inspired):
- Exit codes: 0=clean, 1=warning, 2=malicious (scriptable)
- --doctor health check (server, ollama, repo status)
- --scan-only mode (scan without building)
- IOC match display in malicious blocks
- Suspicious packages: interactive install prompt

All IOC fetches run concurrently for speed.

aur_shield/scanner.py

@@ -1,6 +1,7 @@
 """LLM scanner — sends PKGBUILD to Ollama for security analysis."""
 from __future__ import annotations
 
+import asyncio
 import json
 import re
 import subprocess
@@ -16,6 +17,7 @@ from .ioc_fetcher import (
     fetch_all_iocs, check_package_against_iocs,
     check_typosquatting, IOCEntry, IOCResult, Confidence,
 )
+from .extended_iocs import fetch_extended_iocs
 
 
 class ScanVerdict(str, Enum):
@@ -49,7 +51,12 @@ async def pre_check_iocs(package: str) -> tuple[list[str], list[dict], list[dict
     typo_dicts = []
 
     try:
-        iocs = await fetch_all_iocs()
+        # Fetch from both base + extended IOC sources concurrently
+        base_iocs, ext_iocs = await asyncio.gather(
+            fetch_all_iocs(),
+            fetch_extended_iocs(),
+        )
+        iocs = base_iocs + ext_iocs
 
         # Exact match
         result = check_package_against_iocs(package, iocs)