fix(pkg-inventory): state the orphan law, test the boundary it rests on, stop --help mid-code

Three things from the review (#60), one of them a finding of my own that did not
survive measurement:

- The reported defect — additions never subtract `pacman -Qtdq`, so an orphan can
  be emitted as a manifest line — is wrong. A package carries one install reason:
  `-Qtdq` selects installed-as-dependency, additions come from `-Qqe`, so the sets
  are disjoint (blankpad: 206 explicit, 3 orphans, none in common). A subtraction
  would be dead code that looks like a guard, so the header now says why not to
  add one. The packages page law was rewritten to the same effect.
- What the old test should have pinned: an implicit dependency installed AFTER
  the baseline. Only `-Qqe` keeps it out of drift — mutate that query to `-Qq` and
  the new test goes red (verified), where the old assertion passed no matter what.
- `--help` printed `set -euo pipefail` and the LC_ALL line as documentation: the
  hardcoded sed range ran past the comment block. It now stops at the first line
  of code, so the header can keep growing.

Refs #60

tests/pkg-inventory.bats

@@ -39,15 +39,18 @@ EOF
 [2026-03-04T09:00:00-0800] [ALPM] installed bun (1.2-1)
 [2026-03-04T09:30:00-0800] [ALPM] upgraded filesystem (2026.01.01-1 -> 2026.03.01-1)
 [2026-03-05T09:00:00-0800] [ALPM] installed nirimod-git (r7-1)
+[2026-03-07T09:00:00-0800] [ALPM] installed libstray (1.0-1)
 [2026-03-06T09:00:00-0800] [ALPM] removed base (3-1)
 EOF
 
   # --- installed state --------------------------------------------------------
   # ghostty/zoxide/neovim/typora declared. libfoo: explicit, arrived with the installer.
-  # bun/nirimod-git: installed by hand afterwards, undeclared. python-hatchling: orphan.
-  printf '%s\n' base bun filesystem ghostty libfoo neovim nirimod-git typora zoxide > "$TEST_TMP/local-all"
+  # bun/nirimod-git: installed by hand afterwards, undeclared. python-hatchling and libstray:
+  # installed as dependencies and now unrequired (pacman -Qtdq). libstray arrived AFTER the
+  # baseline, so the date filter alone cannot keep it out of drift — only the explicit query can.
+  printf '%s\n' base bun filesystem ghostty libfoo libstray neovim nirimod-git typora zoxide > "$TEST_TMP/local-all"
   printf '%s\n' bun ghostty libfoo neovim nirimod-git typora zoxide > "$TEST_TMP/local-explicit"
-  printf '%s\n' python-hatchling > "$TEST_TMP/orphans"
+  printf '%s\n' python-hatchling libstray > "$TEST_TMP/orphans"
   # nirimod-git is deliberately ABSENT here: no sync db can serve it, which is the fact that
   # routes it to aur.pkgs in the test below.
   printf '%s\n' bun ghostty neovim typora zoxide libfoo vlc python-hatchling base filesystem > "$TEST_TMP/sync-all"
@@ -131,11 +134,34 @@ ADDITIONS() { section "^undeclared additions" "^installer-provided"; }
   [[ "$(section "^declared," "^orphans")" == *vlc* ]]
 }
 
-@test "orphans are reported as ignored and never emitted" {
+@test "orphans are named on their own line, not mixed into the drift answer" {
   run "$SCRIPT"
-  [[ "$output" == *orphans*python-hatchling* ]]
+  [[ "$(section "^orphans" "^flatpak")" == *python-hatchling* ]]
+  [[ "$(ADDITIONS)" != *python-hatchling* ]]
+}
+
+@test "a dependency installed after the baseline is never drift, orphan or not" {
+  # Drift means `pacman -Qqe` — you asked for this one. libstray arrived as a dependency
+  # after install day and is now unrequired, so the baseline filter does not exclude it:
+  # only the explicit query does. Swap -Qqe for -Qq and every dependency on the machine,
+  # dead ones included, becomes a manifest line install.sh will reinstall on a rebuild.
+  run "$SCRIPT"
+  [[ "$(ADDITIONS)" != *libstray* ]]
+  [[ "$output" == *"undeclared additions (declare these): 2"* ]]
+  [[ "$(section "^orphans" "^flatpak")" == *libstray* ]]
   run "$SCRIPT" --emit
-  [[ "$output" != *python-hatchling* ]]
+  [[ "$output" != *libstray* ]]
+}
+
+@test "--help prints the header and stops before the shell" {
+  # The header IS the contract (report shape, exit status, seams). A hardcoded line range
+  # that runs past the comment block hands the reader `set -euo pipefail` as if it were
+  # documentation.
+  run "$SCRIPT" --help
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"Exit status"* ]]
+  [[ "$output" != *"pipefail"* ]]
+  [[ "$output" != *"LC_ALL"* ]]
 }
 
 @test "--baseline moves packages installed on that date into the installer set" {