… and TailorPrincipal unification

Add three codemods that the upgrade runner applies when migrating from
1.x to 2.x:

- `v2/test-run-arg-input` strips the deprecated `{ "input": ... }`
  wrapper from `tailor-sdk function test-run --arg` JSON in
  package.json scripts, shell scripts, and Markdown code blocks.
- `v2/sdk-skills-shim` rewrites `tailor-sdk-skills` invocations to
  `tailor-sdk skills install` across package.json, shell, YAML, and
  Markdown files.
- `v2/principal-unify` renames TailorUser, TailorActor, and
  TailorInvoker to the unified TailorPrincipal, drops
  `unauthenticatedTailorUser` (replacing value references with
  `null`), and renames `user` to `caller` inside `createResolver`
  body parameters and member accesses.

Generalize the fixture harness so each codemod can declare multiple
`tests/<case>/` directories with arbitrary file extensions, and treat
cases with no `expected.*` as no-change expectations. Wire the new
transforms into the registry and tsdown entries, and ignore the
fixture trees from oxlint and oxfmt to keep representative user code
samples intact.

… cleanup in v2/principal-unify

Resolve the two caveats noted on the codemod:

- When `unauthenticatedTailorUser` import removal empties an SDK
  import statement, post-process the result to drop leading blank
  lines and collapse runs of three or more newlines down to one
  empty line.
- For `createResolver` bodies that locally redeclare `user`,
  collect the byte ranges of the enclosing scopes and skip
  renaming `user` references within them. Param-level destructure
  and references outside the shadow zone are still rewritten to
  `caller`.

Add a `shadow` fixture covering an inner-block redeclaration and
trim the leading blank lines from the `unauthenticated` expected
fixture.

- Skip the null rewrite when unauthenticatedTailorUser is the object of a
  member expression so the codemod no longer emits null.id; the import is
  still dropped so the resulting type error points authors at the broken
  access.
- Match @tailor-platform/sdk/test imports as well so the documented test
  helper unauthenticatedTailorUser is removed there too.
- Restrict resolver-body destructuring rewrites to the top-level object
  pattern. Nested patterns like ({ input: { user } }) are left alone, and
  aliased pairs like ({ user: currentUser }) now rewrite the property key
  to caller while preserving the local binding.
- Dedupe TailorPrincipal across multiple SDK import statements so a file
  that splits TailorUser and TailorActor across imports collapses to one
  TailorPrincipal binding.
- Skip ctx.user rewrites that sit inside nested functions which re-bind
  the resolver context name (items.map((ctx) => ctx.user.id)).

Add fixtures for each case and update the unauthenticated expected
output, which previously asserted the broken null.id behavior.

…cture, chained shell commands

principal-unify:
- Track local names introduced by aliased imports (e.g. unauthenticatedTailorUser
  as testUser) and rewrite their references to null too.
- Include shorthand_property_identifier (object literal shorthand) in body
  rewrites so ({ user }) => ({ user }) becomes ({ caller }) => ({ caller })
  instead of leaving the return value referencing an undefined binding.
- Rewrite destructures that read from the resolver context, so
  const { user } = ctx becomes const { caller: user } = ctx, preserving the
  local binding name.

test-run-arg-input:
- Tokenize lines on unquoted shell command boundaries (;, &&, ||, |, &) and
  only run the {input: ...} unwrap on segments that actually contain
  tailor-sdk function test-run, so chained commands like
  `tailor-sdk function test-run ... --arg '{"input":...}' && other-cli --arg '{"input":...}'`
  no longer corrupt the unrelated argument.

Add fixtures for each new case (aliased-unauthenticated, object-shorthand-return,
ctx-destructure, chained-commands).

…ler key conflict, arg continuations

principal-unify:
- Body-identifier rewrites in the destructured-resolver path now go through
  collectAllShadowRanges, so a nested arrow that re-binds `user` as its own
  parameter (e.g. `items.map((user) => user.id)`) keeps its inner reference
  pointing at the inner binding instead of being incorrectly renamed.
- collectCtxShadowRanges also treats `var ctx = ...` / `let ctx = ...` style
  re-bindings of the resolver context name as shadows, so subsequent
  destructures of the rebound variable are not mistaken for the resolver
  context.
- hasCallerBindingConflict additionally checks the property `key` of pair
  patterns, so `({ user, caller: x })` is detected as conflicting with the
  shorthand rename instead of producing a duplicate-key destructure.

test-run-arg-input:
- The shell-line argument regex accepts the JOIN_MARKER as part of the
  separator group, so a backslash-newline continuation between `--arg` and
  the quoted JSON still matches and the wrapper is unwrapped.
- The marker itself is now plain ASCII (`SDK_CODEMOD_JOIN`) so the regex can
  reference it as a literal alternative without escaping or stray bytes.

Add fixtures (param-shadow-user, ctx-rebound, caller-key-conflict,
multiline-arg-continuation) covering each branch.

… and pattern-aware

principal-unify:
- collectAllShadowRanges previously used `inside: { kind: "variable_declarator" }`,
  which also matched value-side identifier references such as `user` in
  `const userId = user.id`. Walking up to the enclosing scope from such a
  match marked the entire body as shadowed, so every body rename was
  silently suppressed and the codemod produced `({ caller }) => { const x =
  user.id; ... }` instead. The scan now iterates `variable_declarator` nodes
  directly and only consults `field("name")`.
- Added a shared `patternBindsName` helper that recurses through
  `object_pattern`, `array_pattern`, `object_assignment_pattern`, `pair_pattern`,
  `assignment_pattern`, and `rest_pattern` so destructured parameters like
  `({ user }) => ...` and `(({ user, items }) => items.map(({ user }) => user))`
  are recognised as re-bindings of `user`. functionRebindsName uses the same
  helper for both single-arrow params and `formal_parameters` children.

test-run-arg-input:
- Updated the JOIN_MARKER comment to describe the actual ASCII strategy
  instead of the inaccurate "Unicode private-use area" claim left over from
  an earlier iteration.

Add fixtures (body-with-derived-const, nested-destructure-shadow) covering
the previously-broken behaviour.

Apply v2 CLI naming conventions to user code: collapse the
`crash-report` multi-word command to `crashreport` and rewrite
camelCase long options (`--executionId`, `--executorName`,
`--jobId`) to their kebab-case form across package.json scripts,
shell, CI YAML, and Markdown. Optional `@version` pins on the
binary are preserved.

Drop the camelCase long option transform (`--executionId` → `--execution-id`,
etc.). The targeted identifiers are positional arguments in the SDK CLI, not
long flags, so user scripts don't carry them and the transform had no
real-world target. The transform now only rewrites
`tailor-sdk crash-report` → `tailor-sdk crashreport`. Update fixtures,
registry description, and changeset bullet to match. Add a no-match case
asserting the camelCase positional tokens are intentionally left alone.

Replace `auth.invoker("name")` calls with the bare `"name"` string
literal and drop the `auth` import when no other reference remains.
Calls whose argument is not a literal string (`auth.invoker(variable)`,
template literals) are intentionally left untouched. Mirrors the
deprecation in #971: importing `auth` from
`tailor.config.ts` into runtime files pulls Node-only modules into
the bundle.