Pass --needed to pacman so a satisfied package is skipped

[NovusEdge]

Problem

Arch's package install verb reinstalls a package that is already present.
internal/guest/bundled/arch.toml:16 reads:

install = ["pacman", "-S", "--noconfirm"]

Without --needed, pacman -S downloads and reinstalls every named package,
even one at the current version.

Effect

devtools installs base-devel on Arch, and build-deps installs
base-devel too. A VM that selects both downloads and reinstalls the whole
group a second time. The recipes still succeed, so this costs time and network
rather than correctness. Any two recipes that name a shared package pay the
same cost.

Proposal

Add --needed to the install verb and to scaffold_install, so a satisfied
package is skipped.

Acceptance criteria

• internal/guest/bundled/arch.toml passes --needed in install and in
  scaffold_install.
• A test asserts the argv, in the shape the guest table tests already use.
• The Arch row of the recipe live matrix passes with devtools and
  build-deps selected together, and the second install reports nothing to do.

Evidence

Found by the whole-branch review of #100.