Add cachy-auto-update: unattended background updates for CachyOS

A root systemd service applies pacman, AUR, Flatpak and AppImage updates on
its own, gated on battery state, gaming activity and whether anybody else is
using the package system. The CLI is deliberately two switches plus status.

No user password is stored anywhere: pacman runs as root directly, and the AUR
step - which makepkg forbids running as root - drops to a locked system account
that sudoers permits to call pacman without a password.

res/config/cachy-auto-update.conf

@@ -0,0 +1,94 @@
+# cachy-auto-update configuration
+#
+# One "Key=Value" per line, '#' starts a comment. The file is parsed, never
+# sourced, so shell syntax has no special meaning here.
+#
+# After editing run:  systemctl restart cachy-auto-update.timer
+# Documentation:      man cachy-auto-update
+
+# ---------------------------------------------------------------------------
+# Main switches - normally set through `cachy-auto-update enable/disable`
+# ---------------------------------------------------------------------------
+
+# Apply updates automatically in the background.
+# Off after installation: a freshly installed package should not start
+# rebuilding the machine before anybody asked it to.
+Enabled=no
+
+# Show a desktop notification after an update, and whenever something needs
+# attention.
+Notifications=yes
+
+# ---------------------------------------------------------------------------
+# When
+# ---------------------------------------------------------------------------
+
+# How much time has to pass between two update runs. Accepts a plain number of
+# seconds or a suffix of s, m, h, d, w.
+# The systemd timer ticks hourly regardless; this is what decides whether a
+# tick actually does anything, which is also how a postponed run retries.
+UpdateInterval=1d
+
+# Never update while the battery is below this percentage. Ignored on mains
+# power and on machines without a battery.
+MinBatteryPercent=40
+
+# Update only while plugged in. Stricter than MinBatteryPercent.
+RequireAC=no
+
+# Postpone the update while a game is running (GameMode, known game processes,
+# or an application blocking idle).
+SkipWhenGaming=yes
+
+# ---------------------------------------------------------------------------
+# What
+# ---------------------------------------------------------------------------
+
+UpdateAUR=yes
+UpdateFlatpak=yes
+UpdateAppImages=yes
+
+# Also rebuild -git / -devel AUR packages. Off by default: these rebuild
+# constantly and break more often than released packages.
+UpdateDevel=no
+
+# Which AUR helper to use: auto, paru, yay or pikaur.
+AURHelper=auto
+
+# When a new package has to replace or remove an existing one, decide it
+# automatically instead of aborting the update. Straightforward replacements
+# are handled either way; this covers the case where pacman would otherwise
+# stop and ask.
+AutoResolveConflicts=yes
+
+# Packages that are never updated automatically, space separated.
+# Example: IgnorePkg=linux linux-headers nvidia
+IgnorePkg=
+
+# ---------------------------------------------------------------------------
+# Housekeeping - all off by default
+# ---------------------------------------------------------------------------
+
+# Trim the pacman package cache after an update.
+CleanCache=no
+
+# How many old versions per package to keep when CleanCache is on.
+KeepOldPackages=3
+
+# Remove packages that were installed as dependencies and are no longer needed.
+RemoveOrphans=no
+
+# ---------------------------------------------------------------------------
+# Notification detail
+# ---------------------------------------------------------------------------
+
+# Say something after a successful update. Nothing is ever shown when there
+# was nothing to do.
+NotifyOnSuccess=yes
+
+# Report failures.
+NotifyOnError=yes
+
+# Point out that a kernel update needs a restart. The machine is never
+# restarted automatically.
+NotifyReboot=yes