feat: agent assisted upgrades - #129

What & why

Nimbus upgrades currently rely on type errors and release notes, which cannot reliably cover copied or customized project code.

This PR adds a manifest-driven workflow that selects required work where lastReviewedNimbusVersion < introducedIn <= installedVersion, applies only canonical migrations, and records completed reviews in nimbus.json.

What changes

• Adds nimbus-docs migrate with human-readable, JSON, diff, dry-run, and agent-handoff output.
• Adds a comprehensive upgrade manifest with manual guidance for every breaking change.
• Automatically migrates partialHeadings.resolvePartialId only when the change is common, mechanical, and canonically detectable.
• Returns ambiguous or customized source as a bounded review task.
• Integrates outstanding migrations into check, outdated, and Astro build validation.
• Adds safe, per-file starter updates while keeping customized starter and registry code review-only.
• Enforces linked changesets, compatible version bumps, and manifest continuity in CI.
• Synchronizes first-party reviewed baselines during versioning.

Existing projects without a baseline must run migrate --from <version>. Builds remain blocked until required migrations and reviews are completed.

Safety and review focus

• Writes require path containment, exact preimages, atomic replacement, and post-write verification.
• Nimbus emits agent-readable tasks but never launches an agent.
• Framework behavior lives in nimbus-docs; the starter only carries its committed baseline.
• No generated template branch files are edited.
• Review baseline selection in _internal/upgrades.ts, transform boundaries in _internal/migrations.ts, and transactions in cli/migrate.ts.

Verification

• pnpm typecheck
• pnpm -r test
• pnpm templates:check
• pnpm test:upgrades
• pnpm upgrades:check
• pnpm lint