This is not caused by paru. The `download-*` directories are created by
libalpm (pacman's library) as part of its download sandboxing feature.

When `DownloadUser` is set in `pacman.conf` (defaults to `alpm` on current
Arch installs), libalpm creates a temporary `download-XXXXXX` directory via
`mkdtemp()` in the cache dir, `chown`s it to the sandbox user, downloads
packages into it, then moves the files back to the cache dir.

The cleanup function (`_alpm_remove_temporary_download_dir`) runs at the end
of the download, but early-return error paths skip it, leaving the empty
directories behind. This happens with plain `pacman -Syu` as well.

Relevant pacman source:

- `_alpm_download_dir_setup()` creates the directory:
  https://gitlab.archlinux.org/pacman/pacman/-/blob/2979f35840f1/lib/libalpm/util.c#L959-1010

- `_alpm_remove_temporary_download_dir()` is supposed to clean it up:
  https://gitlab.archlinux.org/pacman/pacman/-/blob/2979f35840f1/lib/libalpm/util.c#L1017-1042

- The cleanup call in `dload.c` that gets skipped on error:
  https://gitlab.archlinux.org/pacman/pacman/-/blob/2979f35840f1/lib/libalpm/dload.c#L1288-1291

Introduced in commit e1a7b83e ("Download to a temporary directory owned by
the Download user").

You can safely remove them:

    sudo find /var/cache/pacman/pkg -maxdepth 1 -type d -name 'download-*' -delete

Or disable the sandbox entirely with `DisableSandbox` in `pacman.conf`, though
that is not recommended.