Model what each parser does with an empty and a dangling directive

Review of the previous commits turned up four places where the predicates
and their tests disagreed with the tools they are modelling, each checked
against udevadm verify, systemd-analyze verify and visudo -cf rather than
against reading of the sources.

An empty ExecStop= resets the list, so a unit an administrator neutralised
that way runs nothing at shutdown and is no longer ours to remove; the
predicate now tracks the last state instead of returning on the first home
path it sees. A file whose last line ends in a backslash still carries a
live directive for systemd, so the pending logical line is emitted at EOF;
udev ignores such a line and sudo rejects the file outright, so this costs
those two nothing. The scanner's taint pass now reads += appends, which its
own comment already promised: the value of an append is no use, but a name
that reaches a user root through one has to be judged on it.

Two regression guards passed against the implementations they were written
for. The udev continuation fixture put the whole RUN+= below the comment, so
it matched whether or not the pending half was carried across; the split now
falls inside the RUN+= value. The sudoers one kept its file on the strength
of a spec above the comment, so it could not fail either; the hand-written
spec now sits below. Both fail against a mutant that discards the pending
line. The comment above the second also claimed a continued comment stays a
comment, which visudo contradicts.

migrations/1788025225.sh

@@ -67,6 +67,12 @@ active_lines() {
     emit_logical "$logical$line"
     logical=""
   done
+
+  # A file whose last line ends in a backslash still carries a live directive for
+  # systemd: `systemd-analyze verify` resolves an ExecStop= written that way.
+  # udev ignores the dangling line and sudo rejects the file outright, so emitting
+  # it costs those two nothing.
+  emit_logical "$logical"
 }
 
 # One logical line, whitespace collapsed so a reformatted copy still compares
@@ -195,6 +201,7 @@ plymouth_unit_runs_from_home() {
   local home_pattern="^(/home/[^/]+|/root)/\\.local/share/omarchy/bin/$binary\$"
   local line word
   local -a words
+  local matched=1
 
   while IFS= read -r line; do
     if [[ ! $line =~ $exec_stop_pattern ]]; then
@@ -203,6 +210,11 @@ plymouth_unit_runs_from_home() {
 
     read -ra words <<<"${BASH_REMATCH[1]}"
     if (( ! ${#words[@]} )); then
+      # An empty assignment resets the list, so nothing named before it still
+      # runs. `systemd-analyze verify` reports the missing command for a unit
+      # with one ExecStop=, and reports nothing once a bare ExecStop= follows it.
+      # An administrator who neutralised the unit this way is left alone.
+      matched=1
       continue
     fi
 
@@ -214,11 +226,13 @@ plymouth_unit_runs_from_home() {
     done
 
     if [[ $word =~ $home_pattern || $word == "$HOME/.local/share/omarchy/bin/$binary" ]]; then
-      return 0
+      matched=0
+    else
+      matched=1
     fi
   done < <(active_lines systemd)
 
-  return 1
+  return $matched
 }
 
 # /etc/sudoers.d is 0750 root:root as shipped, and omarchy-migrate runs as the