Pin the prep-time guards, and say why an operand's set is the narrow one

The guards report an invariant break instead of computing around it, and no
data reaches them, so they are called directly: coverage 97.4% -> 97.7%,
which also covers the empty-cover skip through a literal operand.

operandDraw's doc keeps why neither wider set works, since both were tried
here — containment reaches a sibling the operand never renders, the render
closure reaches a source two operands share — and drops the rest.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

builtins_test.go

@@ -193,3 +193,27 @@ func TestRegistryShapes(t *testing.T) {
 		}
 	}
 }
+
+// TestArgGuardsPanic pins the guards that report a builtin arg its check should
+// have rejected. No data reaches them — checkFunc runs a builtin's check before
+// compileOps ever calls prep — so they are exercised directly.
+func TestArgGuardsPanic(t *testing.T) {
+	for name, call := range map[string]func(){
+		"atoi on an unvalidated arg": func() { atoi("nope") },
+		"atof on an unvalidated arg": func() { atof("nope") },
+	} {
+		mustPanic(t, name, call)
+	}
+}
+
+// mustPanic fails unless call panics, which is what separates a reported
+// invariant break from a silently wrong value.
+func mustPanic(t *testing.T, name string, call func()) {
+	t.Helper()
+	defer func() {
+		if recover() == nil {
+			t.Errorf("%s: no panic, want the invariant reported", name)
+		}
+	}()
+	call()
+}