fix(install): manifest parser emitted comment-padded tokens; AUR phase must run unprivileged (makepkg refuses root) with primed sudo timestamp

scripts/install.sh

@@ -37,9 +37,8 @@ SUDO() {
 }
 
 read_manifest() { # $1 = manifest path; emits package names, strips comments/blanks
-  sed 's/#.*//' "$1" | tr -d '\r' | awk 'NF'
+  sed 's/#.*//' "$1" | tr -d '\r' | awk '{if ($1) print $1}'
 }
-
 # ---- desired-minus-installed delta ------------------------------------------
 PKGS=()
 for m in common.pkgs "$HOST.pkgs"; do
@@ -82,11 +81,16 @@ if [[ ${#AUR_PKGS[@]} -gt 0 ]] && ! pacman -Qq yay >/dev/null 2>&1; then
   SUDO pacman -S --needed --noconfirm -- yay
 fi
 
-for p in "${AUR_PKGS[@]}"; do
-  printf '%s\n' "${INSTALLED[@]}" | grep -qx -- "$p" || {
-    YAYFLAGS="--answerclean None --answerdiff None" SUDO yay -S --needed --noconfirm -- "$p"
-  }
-done
+# AUR builds must NOT run as root (makepkg refuses); yay escalates only for
+# the final package install via its internal sudo — prime the timestamp cache.
+if [[ ${#AUR_PKGS[@]} -gt 0 ]]; then
+  if [[ -n "${FRANK_SUDO_PW:-}" ]]; then printf '%s' "$FRANK_SUDO_PW" | sudo -S -p '' true; fi
+  for p in "${AUR_PKGS[@]}"; do
+    printf '%s\n' "${INSTALLED[@]}" | grep -qx -- "$p" || {
+      YAYFLAGS="--answerclean None --answerdiff None" yay -S --needed --noconfirm --aur -- "$p"
+    }
+  done
+fi
 
 # ---- host-gated enablement ---------------------------------------------------
 case "$HOST" in