feat(v1.55.0): add remove-bui-anchor-render-props codemod

[schultzp2020]

Summary

-<Link href="/catalog" render={<RouterLink render={<a />} />}>Catalog</Link>
+<Link href="/catalog" /* TODO(backstage-codemod): review render migration manually (custom render prop or spread props) */ render={<RouterLink render={<a />} />}>Catalog</Link>

-<Link href="/catalog" render={(<a />)}>Catalog</Link>
+<Link href="/catalog">Catalog</Link>

Follow-up for #151 on top of f2476ae:

• P1: stop recursive opening.findAll({ kind: 'jsx_attribute' }) scans. Only inspect direct opening attributes so nested render props inside custom render trees are untouched.
• P2: treat parenthesized bare anchors (render={(<a />)}) as safe anchor render and remove them.
• Preserve existing semantic import-binding and shadowing protections/fixtures.

Closes #151.

Evidence

Red/green fixtures

• Added tests/nested-render-prop-todo/* (red on previous head): proved nested <RouterLink render={<a />} /> was incorrectly counted as render-prop-removed and mutated.
• Added tests/parenthesized-anchor-safe/* (red on previous head): proved render={(<a />)} incorrectly emitted TODO.
• After fix both fixtures pass; full package fixture set now 13/13.

Validation @ HEAD 8553f3c

• yarn workspace @backstage/remove-bui-anchor-render-props test ✅ (13 tests + workflow validate)
• yarn format:check ✅
• yarn lint ✅
• yarn test ✅
• yarn check:changed ✅

Performance audit (JSSG guidance: no-op baseline vs real, same workflow entry path)

Corpus: synthetic mostly-inert TSX tree (1545 files: 1500 inert, 30 @backstage/ui no-render, 10 safe renders, 5 custom nested renders).

Ran codemod workflow run -w workflow.yaml --target <corpus> --dry-run --no-interactive --allow-dirty and equivalent no-op workflow 3x each:

• no-op ms: 1931, 1900, 2006 (median 1931)
• real ms: 1905, 1896, 1914 (median 1905)
• median slowdown ratio: 0.987x (within noise; no substantive slowdown)

Idempotence / edit evidence on apply copy:

• apply run metrics: render-prop-removed(Link)=10, todo-manual-review(Link, custom-render-prop)=5
• content checks: 10/10 safe render files removed render; 5/5 custom files gained TODO and preserved nested render={<RouterLink render={<a />} />}
• rerun dry-run produced no metrics (idempotent)

Approved clean-source QA (read-only)

• Local workflow dry-run on Backstage snapshot 0863f0349c63fa7475b89aed71b6fb8214791394: rc=0, no diff/TODO candidates emitted; snapshot remained clean.
• Local workflow dry-run on clean detached community-plugins snapshot 4c760a005dd582df1a61aec39ae50ad565f6dbbc: rc=0, no diff/TODO candidates emitted; snapshot remained clean. Original dirty checkout untouched.
• No real-source positive candidates were found in these snapshots; positive behavior is evidenced by the 13 fixtures and 1545-file synthetic benchmark above. CLI does not emit an explicit match counter for these no-op dry-runs.

Full-suite fixture side effect (post-#164 integration)

• yarn test passed twice on the integrated branch, but both runs generated the same untracked 145-byte codemods/v1.55.0/remove-relations-compatibility-config/tests/flow-inline-comment-preserved-when-catalog-emptied/metrics.json (blob 42847c1): a pre-existing feat(v1.55.0): add remove-relations-compatibility-config codemod #162 fixture with no tracked metrics file. This is a known test side effect, not a claim that full test leaves the worktree clean.
• Preserved evidence outside the worktree, then removed only that exact generated file after completed tests; no feat(v1.55.0): add remove-relations-compatibility-config codemod #162 source change was included in this PR. yarn check:changed and 13/13 package fixtures passed, and the shipped feat(v1.55.0): add remove-bui-anchor-render-props codemod #165 workflow's two-case output and rerun idempotence passed. A dedicated feat(v1.55.0): add remove-relations-compatibility-config codemod #162 fixture follow-up can track the missing metrics file.

Merge Danger

Door: two-way

Codemod package can be reverted before publication; migration output still requires user review of TODO cases.

Blast Radius: BUI link render prop migration

Changes are constrained to direct opening attributes on imported target components; nested custom-render trees are now explicitly protected from accidental recursive attribute edits.

[schultzp2020]

Review-blocked: imported component provenance currently matches JSX names by text, so a local Link or namespace alias shadowing the @backstage/ui import could have its unrelated render prop removed. Adding shadowed-binding fixtures and binding-aware guard; keep draft until corrected diff receives fresh review.