test(forgejo-runner): drive the liveness note's state boundary

codex and kimi are right: the four checks proved the LINES EXIST and nothing
proved they fire only when the unit is active. kimi deleted the state guard and
the suite stayed 790/790 green, so the boundary #133 cares about most — no
misleading liveness note on an absent or inactive unit — was unprotected. #133's
own test plan says driven, not grepped where behaviour can be executed, and this
was the line it crossed.

The note is now a function, which is what makes the boundary executable, and
the suite drives it on active (note present, remedy named), inactive (empty)
and unset (empty). Removing the guard now fails two checks instead of none.

The no-warn and no-network guards stay greps: those properties are source-level
by nature, as kimi noted.

Two things I got wrong on the way, both caught by running it rather than
reading it: the function was defined below its call site (shellcheck SC2218),
and the block reused $WORK, which is rm -rf'd at :3206 long before it — so it
now takes its own scratch dir like the file's other fixtures.

Refs #133

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

test/cli.sh

@@ -3433,7 +3433,7 @@ check "forgejo-runner: the liveness note is informational, never a WARNING" 1 ""
 # Its own scratch dir: $WORK is rm -rf'd at :3206, well before this block.
 FJS_DIR="$(mktemp -d)"
 FJSW="$FJS_DIR/fjs-note.sh"
-{ echo 'log() { printf "rig-forgejo-runner: %s\n" "$*"; }'
+{ printf '%s\n' 'log() { printf "rig-forgejo-runner: %s\\n" "$*"; }'
   awk '/^forgejo_runner_liveness_note\(\) \{/,/^\}/' "$FJS"
 } > "$FJSW"
 check "forgejo-runner: liveness note extracted (guards the awk)" 0 "forgejo_runner_liveness_note() {" \
@@ -3441,10 +3441,9 @@ check "forgejo-runner: liveness note extracted (guards the awk)" 0 "forgejo_runn
 note_for() { bash -c '. "$1"; forgejo_runner_liveness_note "$2"' _ "$FJSW" "$1"; }
 check "liveness note: an ACTIVE unit is told what active does not prove" 0 "not proof" note_for active
 check "liveness note: …and is given the remedy" 0 "systemctl restart forgejo-runner" note_for active
-check "liveness note: an INACTIVE unit gets nothing" 0 "" \
-  bash -c '[ -z "$(bash -c ". \"$1\"; forgejo_runner_liveness_note inactive" _ "$1")" ]' _ "$FJSW"
-check "liveness note: an ABSENT unit (empty state) gets nothing" 0 "" \
-  bash -c '[ -z "$(bash -c ". \"$1\"; forgejo_runner_liveness_note \"\"" _ "$1")" ]' _ "$FJSW"
+note_is_empty() { [ -z "$(note_for "$1")" ]; }
+check "liveness note: an INACTIVE unit gets nothing" 0 "" note_is_empty inactive
+check "liveness note: an ABSENT unit (empty state) gets nothing" 0 "" note_is_empty ""
 rm -rf "$FJS_DIR"
 # The header contract at :25 — no token, no network call — survives this.
 check "forgejo-runner: status still makes no network call" 1 "" \