`/migrate?from=<host>/<owner>/<name>&crew=<agent>` opens Migrate with that repository and agent chosen, matched on the origin's full host #1472

Replaces #1078 (a person's ask; what done looks like is #1006's). Both tries failed on their own test, "migrate > a link prefills the form and starts nothing": the link's host was compared with the origin's display label (hostLabel, the first DNS label without the port), so git.open-platform.sh never matched.

Intent. A run that needs the owner's credential can leave one link, and his import is one click.

Done looks like.

• [ ] A pure function in its own module (e.g. src/web/pages/migrate-prefill.ts) takes the query and the origins/repositories/agents the page already loaded and returns {repo?, agent?, unmatched: string[]}. from is compared with URL(origin.webUrl).host (host plus any port, lower-cased) followed by /<owner>/<name>. It is never compared with the display label.
• [ ] When from matches, that repository is selected. When crew names an agent the user may put on a crew, that agent is selected and "put a crew on it" is checked.
• [ ] A value that matches nothing is ignored, and the page names it in one escaped line. Both params are length-capped and limited to safe ref characters at the boundary.
• [ ] The GET starts no job and makes no extra fetch: matching uses the list the page already reads. POST is unchanged and keeps its same-origin check.
• [ ] Unit tests for the function cover a host with a port, a host without one, a mismatch and a hostile value. test/migrate.test.ts covers the page: it selects, names a mismatch, escapes, and creates no job.
• [ ] docs/ORIGINS.md documents the link form.
• [ ] Before the pull, bun test test/migrate.test.ts and bunx tsc --noEmit pass in the sandbox, and any new test file is in GATE.

Files. src/web/pages/migrate.ts, src/web/pages/migrate-prefill.ts (new), docs/ORIGINS.md, test/migrate.test.ts, scripts/gate.ts. Fits: scout.