fix(pkg-inventory): state the orphan law, test the boundary it rests on, stop --help mid-code

Three things from the review (#60), one of them a finding of my own that did not
survive measurement:

- The reported defect — additions never subtract `pacman -Qtdq`, so an orphan can
  be emitted as a manifest line — is wrong. A package carries one install reason:
  `-Qtdq` selects installed-as-dependency, additions come from `-Qqe`, so the sets
  are disjoint (blankpad: 206 explicit, 3 orphans, none in common). A subtraction
  would be dead code that looks like a guard, so the header now says why not to
  add one. The packages page law was rewritten to the same effect.
- What the old test should have pinned: an implicit dependency installed AFTER
  the baseline. Only `-Qqe` keeps it out of drift — mutate that query to `-Qq` and
  the new test goes red (verified), where the old assertion passed no matter what.
- `--help` printed `set -euo pipefail` and the LC_ALL line as documentation: the
  hardcoded sed range ran past the comment block. It now stops at the first line
  of code, so the header can keep growing.

Refs #60

omp-docs/tools/packages.md

@@ -8,7 +8,7 @@ tags:
   - provisioning
   - fleet
   - blankpad
-verified: 2026-10-20
+verified: 2026-10-21
 timestamp: 2026-10-20
 ---
 
@@ -48,7 +48,7 @@ undeclared additions (declare these): N        ← exit 1 when N > 0
   aur (needs a helper): <names>                → belongs in packages/aur.pkgs
 installer-provided, undeclared: N + names      → a reinstall supplies these; do not declare
 declared, not installed: <names>               → install.sh installs these
-orphans ignored: <names>                       → pacman -Qtdq
+orphans ignored: <names>                       → pacman -Qtdq, never drift (see the law below)
 flatpak: <app ids>                             → reported only, install.sh installs no flatpaks
 ```
 
@@ -78,15 +78,23 @@ how a manifest becomes a pile of source builds.
 Classify with `pacman -Sl` (world-readable). **`pacman -Sqq` requires root** — a tool that only
 reads the machine must not need sudo to answer a question about it.
 
-**Known gap:** `aur.pkgs` is read for *every* host, so a desktop-only AUR package (a niri module, a
-GUI client) cannot be declared there without asking the headless servers to build it. Such a name is
-still reported as an AUR addition; leave it undeclared until `install.sh` grows a per-host AUR
+**Known gap:** `aur.pkgs` is read for *every* host, so a desktop-only AUR package — the niri
+module `nirimod-git`, say, or a GUI client — cannot be declared there without asking the
+headless servers to build it. Such a name is still reported as an AUR addition and stays
+undeclared (see the note in `packages/blankpad.pkgs`) until `install.sh` grows a per-host AUR
 manifest.
 
 ## Law: orphans never reach a manifest
 
-`pacman -Qtdq` names are packages nothing depends on; emitting them would teach a fresh machine to
-install the same dead weight. They are printed as `orphans ignored` and excluded from `--emit`.
+Drift is `pacman -Qqe` — *explicitly* installed, therefore yours. `pacman -Qtdq` names packages
+installed **as a dependency** that nothing requires any more, and a package carries exactly one
+install reason, so the two sets cannot overlap (blankpad 2026-10-21: 206 explicit, 3 orphans, none
+in common). That is why nothing in `pkg-inventory.sh` subtracts the orphan list from the additions:
+the query is already the guard. Do not add such a subtraction — it cannot fire, and it would bury
+the invariant that matters, *an implicit install is never drift no matter when it arrived*, which
+`tests/pkg-inventory.bats` pins with a dependency installed after the baseline. What the
+`orphans ignored` line is for is the other half: dead weight on the machine that a manifest must
+never teach a fresh box to install.
 
 ## Two traps that produced this tool