Returns groups that currently have the add-on installed but are not in its target group list — typically the result of removing a target after distribution. Use this to drive a clean-up workflow before tightening the targeting.