Model what each parser does with an empty and a dangling directive

Review of the previous commits turned up four places where the predicates
and their tests disagreed with the tools they are modelling, each checked
against udevadm verify, systemd-analyze verify and visudo -cf rather than
against reading of the sources.

An empty ExecStop= resets the list, so a unit an administrator neutralised
that way runs nothing at shutdown and is no longer ours to remove; the
predicate now tracks the last state instead of returning on the first home
path it sees. A file whose last line ends in a backslash still carries a
live directive for systemd, so the pending logical line is emitted at EOF;
udev ignores such a line and sudo rejects the file outright, so this costs
those two nothing. The scanner's taint pass now reads += appends, which its
own comment already promised: the value of an append is no use, but a name
that reaches a user root through one has to be judged on it.

Two regression guards passed against the implementations they were written
for. The udev continuation fixture put the whole RUN+= below the comment, so
it matched whether or not the pending half was carried across; the split now
falls inside the RUN+= value. The sudoers one kept its file on the strength
of a spec above the comment, so it could not fail either; the hand-written
spec now sits below. Both fail against a mutant that discards the pending
line. The comment above the second also claimed a continued comment stays a
comment, which visudo contradicts.

test/shell.d/legacy-power-udev-rules-migration-test.sh

@@ -213,14 +213,16 @@ run_migration
   fail "migration matches the binary the filename promises, not any home path"
 pass "migration matches the binary the filename promises, not any home path"
 
-# udev resumes a continuation across a comment: `udevadm verify` on
-# 'SUBSYSTEM=="power_supply" \' + "# c" + ', RUN+="..."' reports its style warning
-# on line 1, so those three lines are one rule and the rule is live.
+# udev resumes a continuation across a comment: `udevadm verify` reports its
+# complaint on line 1 for a rule split this way, so the three lines are one live
+# rule. The split falls inside the RUN+= value on purpose -- with the whole
+# RUN+= below the comment the assertion passes even against an implementation
+# that throws the pending half away, which is the shape this guards against.
 reset_machine
 cat >"$power_rule" <<'RULE'
-SUBSYSTEM=="power_supply", ATTR{type}=="Mains" \
+SUBSYSTEM=="power_supply", ATTR{type}=="Mains", RUN+="/usr/bin/systemd-run --no-block --unit=omarchy-power-profile \
 # split for readability
-, RUN+="/home/someuser/.local/share/omarchy/bin/omarchy-powerprofiles-set"
+/home/someuser/.local/share/omarchy/bin/omarchy-powerprofiles-set"
 RULE
 run_migration