## Why

Current `ValidatePackage` spawns multiple `pacman` processes per package (-Qip, -Sip calls), causing performance issues when checking many packages. Additionally, `MarkExplicit` is called individually for each package, spawning a separate process per package. Finally, AUR HTTP calls are made per-package. Using the Jguer/dyalpm Go library eliminates process spawning overhead and enables efficient batch operations throughout.

## What Changes

- Replace shell-out to `pacman -Qip`/`pacman -Sip` in `ValidatePackage` with Jguer/dyalpm library calls
- Add unified in-memory package cache to `Pac` struct (replaces existing aurCache), persisting for job duration
- Replace individual `pacman -D --explicit` calls with single batch call
- Batch AUR HTTP queries into single request for all packages not found in pacman databases
- Add Jguer/dyalpm dependency

## Capabilities

### New Capabilities

- **dyalpm-package-query**: Use dyalpm library for querying pacman package databases in batch, falling back to AUR HTTP batch for remaining packages. Results cached for job duration.
- **batch-explicit-mark**: Batch multiple packages into single `pacman -D --explicit` call instead of per-package process spawn.

### Modified Capabilities

None.

## Impact

- **pkg/pacman/pacman.go**: Refactor `ValidatePackage` to accept slice, replace aurCache with unified pkgCache, refactor `MarkExplicit` to accept slice
- **go.mod**: Add Jguer/dyalpm import
- **Performance**: Reduced process spawns from O(n*2 + n AUR) to O(1) for ValidatePackages, O(n) to O(1) for MarkExplicit