refactor(packages): one manifest parser, so a name means one thing to both tools

install.sh and pkg-inventory.sh carried byte-identical copies of read_manifest.
That is the duplicated-code half of the problem; the worse half is untested —
neither script had any test for the grammar that decides what gets installed.

- scripts/lib/manifest.sh is the parser; both scripts source it
- tests/manifest-parser.bats writes the contract first (comments, CRLF, first
  field only, unreadable file fails loudly instead of yielding "nothing desired")
- an unreadable manifest now fails inside the helper rather than depending on
  whichever `set` options the caller happens to run under
- install.sh check mode verified end to end against a stubbed pacman: a CRLF
  manifest with trailing comments resolves to bare names, installed names drop

Refs #60

omp-docs/tools/packages.md

@@ -25,9 +25,13 @@ if both directions are checked.
 ## Manifests
 
 `packages/common.pkgs` (every host) + `packages/<host>.pkgs` (this host) + `packages/aur.pkgs`
-(AUR-only, installed through `yay`). The parser is `sed 's/#.*//'` then the first field, so `#`
-comments trail freely and one token per line is the whole grammar. An unknown `--host` gets the
-common manifest only: a wrong-host run is a no-op, not a hazard.
+(AUR-only, installed through `yay`). **One parser reads them for both tools**:
+`scripts/lib/manifest.sh` — `sed 's/#.*//'` then the first field, so `#` comments trail freely and
+one token per line is the whole grammar; an unreadable manifest is a loud failure rather than an
+empty desired list. `tests/manifest-parser.bats` owns that contract. The two scripts carried
+verbatim copies of the body until 2026-10-21, which is exactly how a manifest line can come to mean
+two things to the two halves of the same check. An unknown `--host` gets the common manifest only:
+a wrong-host run is a no-op, not a hazard.
 
 ## Rebuild a workstation
 
@@ -110,5 +114,6 @@ never teach a fresh box to install.
 
 - [tools/index](index.md) · [dotfiles-deploy](dotfiles-deploy.md) (the config tier that follows) ·
   [live-sync](live-sync.md) (the heartbeat that commits machine state)
-- Tests: `tests/pkg-inventory.bats` (fixtures + stubbed `pacman`, no real package database touched).
+- Tests: `tests/pkg-inventory.bats` (fixtures + stubbed `pacman`, no real package database touched)
+  and `tests/manifest-parser.bats` (the grammar above, observed as names in / names out).
 - Refs #51.