Migrate opens prefilled from a link, so the owner's import is one click a run can hand him #1078

Replaces #1006, parked twice:

• the check failed ("capacity: only a forge admin reads or changes it > an admin changes each one from the page, the API and MCP; a wrong value is refused; every change is kept") and the decider saw no point in another try (pull #1016 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.
• the check failed ("capacity: only a forge admin reads or changes it > an admin changes each one from the page, the API and MCP; a wrong value is refused; every change is kept") and the decider saw no point in another try (pull #1039 closed).

Those checks went red on tests this change does not touch. This waits on #1047, which takes them out of the gate, so the check measures this change. Start from today's main. What done looks like is #1006's, unchanged:

---

Pillar: P7 Steering (umbrella #593). Split from #617: the owner's import is one click, and the crew can hand him that click.

Outcome. A link like /migrate?from=git.open-platform.sh/trevato/home-maintenance&crew=<agent> opens the Migrate page with that origin repository and that agent already chosen, so a crew run, or the planner, that needs the owner's credential can leave him one link on an issue. Nothing starts until he presses Migrate.

Acceptance.

• [ ] GET /migrate reads optional from (<host>/<owner>/<name>) and crew (an agent name). When from matches a repository in one of the signed-in user's origins, that option is selected. When crew names an agent they can put on a crew, that agent is selected and "put a crew on it" is checked.
• [ ] A value that matches nothing is ignored, not echoed raw. The page says in one line which one did not match ("No repository git.open-platform.sh/trevato/x in your origins"), escaped.
• [ ] Both params are validated at the boundary (length cap, isSafeRef-style characters). The GET never starts a job. POST is unchanged and keeps its same-origin check.
• [ ] docs/ORIGINS.md (Migrate section) documents the link form.
• [ ] Tests in test/migrate.test.ts: the prefill selects, a mismatch is ignored and named, a hostile value is escaped, and the GET creates no job.

Files. src/web/pages/migrate.ts, docs/ORIGINS.md, test/migrate.test.ts.

Risks. Origin repo lists come from listRemoteRepos, which can be slow or fail: the prefill must not add a second fetch. Match against the list the page already reads.

Done means reachable: Page: /migrate?from=…&crew=… shows the selection. Test: as above. Look: the prefilled page.

Parked by the crew: the check failed ("migrate > a link prefills the form and starts nothing") and the decider saw no point in another try (pull #1314 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("migrate > a link prefills the form and starts nothing") and the decider saw no point in another try (pull #1382 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check failed ("migrate > a link prefills the form and starts nothing") and the decider saw no point in another try (pull #1314 closed)
2. the check failed ("migrate > a link prefills the form and starts nothing") and the decider saw no point in another try (pull #1382 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

replaced by #1472. Both tries failed on their own test: the link's host was compared with the origin's display label (hostLabel, the first DNS label with no port), so it never matched. #1472 says to match on URL(webUrl).host in a pure function with its own unit tests, and to run test/migrate.test.ts in the sandbox before the pull. What done looks like is otherwise unchanged.