feat: migrate Connections URL lookups for Backstage 1.54.0

[schultzp2020]

Summary

 await connections.find({
   type: 'github',
-  url,
+  query: { url },
   authMethods: ['app', 'token'],
 });

AST provenance limits migration to Connections receivers and built-in URL-based types; unknown/computed/spread shapes stay for review. Minor changeset. Closes #144.

Evidence

• Before: tests/unsupported/input.ts has find({ type: 'github', url, [key]() {} }) with key = 'query' and ['q u e r y']; tests/receiver-shapes/input.ts has factory: function({ connections: conn }) { conn.find({ type: 'github', url }) } wired to connectionsServiceRef.
  After: tests/unsupported/expected.ts keeps both ambiguous options unchanged with one TODO each, preserving runtime methods and URL evaluation; tests/receiver-shapes/expected.ts nests URL under query. tests/unrelated proves shadowed renamed conn stays untouched. Red fixtures failed in receiver-shapes and unsupported before the fix; green fixtures (6/6) and schema-valid workflow (base_path: '.') passed afterward.
• Workflow run against temporary input fixtures matched expected; second pass on outputs was byte-identical. No-op workflow benchmark (1,000 inert TS files): 1s, 0 edits. yarn format, yarn format:check, yarn lint, yarn test, yarn check:changed passed; minor changeset remains in PR. Earlier Backstage checkout dry-run completed in 5s with no emitted diff and no checkout changes. Codemod package validator inferred npm incorrectly in this Yarn repo; repo-standard gates passed.
• feat: Backstage 1.54.0 migration - Move Connections lookup URL into query #144 follow-up (91bfd1a): Red parameter-properties-and-escaped-keys fixture showed typed constructor(private readonly connections: Service) missed; query inserted a duplicate query, and escaped url was silently missed. AST required_parameter constructor property provenance now recognizes imported ConnectionsService by definition; readonly-only properties also covered. Ambiguous escaped quoted, computed, bare identifier, and shorthand keys receive one idempotent TODO instead of an unsafe rewrite. Fixture also verifies static/non-property/unrelated receivers unchanged and inline comments preserved. Red fixture failed before fix; 6/6 green afterward. Workflow against temporary fixture matched expected, second pass byte-identical. 1,000 relevant TS files benchmark: 1,000 transformed, 8s wall time under concurrent validation (workflow 7.1s). yarn format, yarn format:check, yarn lint, yarn test, yarn check:changed passed; minor changeset retained.

Merge Danger

Door: two-way

Revert removes the unpublished migration package; no consumer code changes until users run it.

Blast Radius: lookups

Only provable Connections find calls with supported built-in URL types change. Unsupported old shapes receive a TODO; consumers must review custom query contracts.