ReturnRequestPolicy's docblock contradicts its own code on orphan visibility

Start with the ReturnRequestPolicy docblock and compare its orphan-visibility statement with view(), ownsIt(), and the existing tests. Update the documentation to match the behavior those tests already assert: orphan returns are invisible and not writable; do not change the policy code.

ReturnRequestPolicy's docblock says an orphan return — one whose team_id is null — is "visible, so an orphan can be found and fixed, and not writable".

The code does not do that. view() calls ownsIt(), which is false when team_id is null, so an orphan is visible to nobody.

Code and tests agree with each other; only the docblock is out of step. Found while writing the Filament package's docs, where the docblock was the thing being documented from — a comment that describes an access decision that the code does not make is the kind of thing an adopter takes at face value.

Two ways out, and they are not equivalent:

1. Fix the docblock. Orphans are invisible. That is a defensible position: a row with no team cannot be scoped, and showing it to whoever asks is cross-tenant by construction.
2. Fix the code. Orphans become visible-but-not-writable, as written. That needs a deliberate answer to "visible to whom", because "anyone with the view ability" is every tenant.

(1) matches what the tests already assert, so it is the smaller change and the safer default. (2) is a real feature and should be argued for on its own terms if anyone wants it.