Guard against pacman partial upgrades

[trmxvibs]

Arch Linux does not support partial upgrades. Running pacman -Sy and then
installing a package can pull in a dependency built against newer libraries
than the ones installed, which breaks systems. The Arch wiki is explicit
about this.

pkgwrap currently exposes refresh as pacman -Sy and install as
pacman -S, which makes the unsupported sequence easy to reach:

pkgwrap refresh && pkgwrap install some-package

Options to consider

1. Warn from PacmanBackend.refresh() that a bare -Sy is discouraged and
   suggest pkgwrap upgrade (pacman -Syu) instead.
2. Report refresh as unsupported on pacman, pointing at upgrade.
3. Leave the behaviour and only warn on install when the sync database
   looks newer than the installed package set.

Option 1 is the least surprising and doesn't remove a capability. This needs
a decision before any code — please comment rather than opening a PR
straight away.

Acceptance criteria

• A decision recorded in this issue
• Implementation with a test
• README updated to match whatever we choose