It's maybe not exactly what you asked for, but I use EndeavourOS, which basically provides a calamari installer experience for Arch, and installs yay by default. It's not really "hardened" anymore than having firewalld on by default, but it definitely makes it easier to setup Arch on an encrypted volume.

Also, if you wanted hardened, best to stick with OpenBSD or it's ilk. Linux tends not to be hardened easily, and usually severely limits functionality when you do start hardening it (i.e. BlackArch or Parrot).

What’s the threat model you’re hardening against? For most use cases, a stock Archlinux from the wiki with LUKS/LVM is gonna be pretty solid.