feat(compile): add repos_unified codemod for legacy repositories: + checkout: rewrite

Replaces the previous front-matter migration framework approach with the
codemod framework merged in #476. The new 0001_repos_unified codemod
detects the legacy repositories: + checkout: shape in raw YAML and
rewrites it in place to the unified repos: shape before typed
deserialization. Idempotent on already-current sources.

Drops the typed repositories: / checkout: fields from FrontMatter (now
#[serde(skip)] Rust-only fields populated by lower_repos); the codemod
runs first so user YAML never reaches typed deserialization with legacy
keys. resolve_repos is simplified accordingly — the codemod owns the
mixing/legacy concerns.

Updates docs/front-matter.md to point at docs/codemods.md.

Co-authored-by: jamesadevine <4742697+jamesadevine@users.noreply.github.com>

Author: Copilot

docs/front-matter.md

@@ -216,13 +216,15 @@ repos:
     ref: refs/heads/release/2.x
 ```
 
-### Legacy syntax (deprecated)
-
-The legacy `repositories:` + `checkout:` fields still work but emit a
-deprecation warning. They cannot be mixed with `repos:`. Migrate by
-converting each `repositories:` entry into a `repos:` entry — any entry
-that appeared in `checkout:` keeps the default `checkout: true`; any that
-did not should set `checkout: false`.
+### Legacy syntax (auto-rewritten)
+
+The legacy `repositories:` + `checkout:` fields are auto-converted to
+`repos:` by the [`repos_unified` codemod](codemods.md). On the next
+`ado-aw compile`, any source that still uses the legacy fields is
+rewritten in place to the new shape — each `repositories:` entry
+becomes a `repos:` entry, with `checkout: false` added for entries
+that weren't listed under `checkout:`. Mixing the legacy fields with
+an existing `repos:` block is rejected; pick one shape.
 
 ## Filter Validation