feat(catalog): add st2 catalog migrate-ids

One atomic transaction that makes an existing catalog expressible in decision
0015's identity model without re-keying any durable state.

- A live subject freezes its existing `<host>.<identity>` bus identity as its
  explicit `id`, so every runtime identifier, task ID, socket path, and
  declaration-anchored state path keeps its exact bytes.
- A structurally archived subject freezes the same bytes when they remain unique
  across the combined live-and-archived set. An archived collision — the shape a
  re-projecting generator and an archiving supervisor produce together — receives
  a UUIDv7 in both its declaration and its tombstone, and the reassignment is
  recorded in `.st2/agent-id-migration.json` so a reader of a version-1 durable
  record never retypes colliding bytes into the wrong subject.
- Supervisor references resolve against the combined *pre-migration* index and
  are rewritten to the parent's migrated ID in the same transaction. A missing or
  ambiguous reference refuses before any write with `legacy-supervisor-unresolved`.
- The catalog must already admit: migration re-admits the whole live plane after
  its writes, and a plane that already fails admission would fail that
  re-admission for a reason migration did not cause, leaving every declaration
  rewritten and the generation unmoved. A dry run still reports its full plan.
- `--resume` finishes an interrupted run and may only apply work the interrupted
  transaction planned. A plain rerun over a half-migrated plane refuses.

Edits are span-bounded over exact source bytes through the authoring module's
existing insertion helper, so comments, formatting, and every unrelated byte
survive. TOML and JSON declarations refuse. A Nix-owned declaration IS migrated —
the marker guards interactive authoring, not the one transaction that has to
reach the whole plane — and the receipt names it so its generator can be taught
to emit `id` before the next activation re-projects the file without one.

Author: schickling-assistant

src/agent_author.rs

@@ -1720,7 +1720,7 @@ fn verify_desired_state_candidate(
     ))
 }
 
-fn exact_agent_node<'a>(
+pub(crate) fn exact_agent_node<'a>(
     document: &'a KdlDocument,
     expected_identity: &str,
     expected_host: &str,
@@ -1764,7 +1764,7 @@ fn exact_agent_node<'a>(
     }
 }
 
-fn agent_identity_parts(node: &KdlNode) -> (Option<String>, Option<String>) {
+pub(crate) fn agent_identity_parts(node: &KdlNode) -> (Option<String>, Option<String>) {
     let mut identity = node
         .get(0)
         .and_then(|value| value.as_string())
@@ -1793,7 +1793,7 @@ fn agent_identity_parts(node: &KdlNode) -> (Option<String>, Option<String>) {
     (host, identity)
 }
 
-fn is_nix_managed(node: &KdlNode) -> bool {
+pub(crate) fn is_nix_managed(node: &KdlNode) -> bool {
     node.children().is_some_and(|children| {
         children
             .nodes()
@@ -1855,7 +1855,7 @@ fn parse_field_value(node: &KdlNode, field: PresentationField) -> Result<&str, A
         })
 }
 
-fn quoted(value: &str) -> Result<String, AuthorError> {
+pub(crate) fn quoted(value: &str) -> Result<String, AuthorError> {
     serde_json::to_string(value).map_err(|error| {
         AuthorError::new(
             "unsafe-source-edit",
@@ -1900,7 +1900,7 @@ fn insert_field(
     )
 }
 
-fn insert_node(text: &str, target: &KdlNode, authored: &str) -> Result<String, AuthorError> {
+pub(crate) fn insert_node(text: &str, target: &KdlNode, authored: &str) -> Result<String, AuthorError> {
     let span = target.span();
     let start = span.offset();
     let end = start + span.len();
@@ -2038,7 +2038,7 @@ fn remove_field(text: &str, node: &KdlNode) -> Result<String, AuthorError> {
     Ok(replacement)
 }
 
-fn line_indent(text: &str, offset: usize) -> Option<String> {
+pub(crate) fn line_indent(text: &str, offset: usize) -> Option<String> {
     let prefix = text.get(..offset)?;
     let start = prefix.rfind('\n').map_or(0, |newline| newline + 1);
     let indent = prefix.get(start..)?;