feat: rename OpenAPI validation command for Backstage 1.54 (#147)

[schultzp2020]

Summary

+ package.json scripts: JSON AST `verify` → `validate`
+ .github/workflows/*.{yml,yaml} steps[].run: YAML AST `verify` → `validate`
+ target/**/*.sh: bounded literal-command lexer `verify` → `validate`

Implements #147. Excludes prose, historical docs, aliases, substitutions, here-documents, symlinked paths, and the removed 1.53 openapi test command. Includes minor changeset; no manual version bump.

Closes #147

Evidence

• Before: disposable scripts/check.sh: backstage-repo-tools repo schema openapi verify --strict; .github/workflows/check.yml step: yarn backstage-repo-tools repo schema openapi verify --strict.
  After: run 231b2979-fa80-4658-bb7a-2ccddad4747a, unrelated caller cwd, explicit -t target containing spaces: actual .sh diff verify → validate; CI YAML diff verify → validate; package.json script changed; docs/history.sh stayed verify.

• Dry-run: run 48682a4f-c2c2-4c30-9e1e-da3f3c3ea88c with explicit -t --dry-run --allow-dirty; SHA256 of disposable package JSON and .sh unchanged. No-op: run 4c6dd686-982f-4484-9d4e-883ecd3a4207, 2.77s, hashes unchanged; real run 2.40s on same path.

• yarn format, yarn format:check, yarn lint, yarn test, yarn check:changed, package JSON/YAML fixtures, shell positive/negative/symlink tests, workflow validation passed.

• P1/P2 follow-up (a4455d2): red hard-link fixture reproduced an outside-target content mutation; after fix nlink > 1 skips linked .sh files. Tests assert outside/inside content and inode unchanged, normal mode preserved, symlink skip, repeat-run idempotence; npm exec -- backstage-repo-tools ... verify rewrites, alias-shadowed direct command stays untouched. Independent disposable explicit -t target with spaces: dry-run SHA unchanged; apply changed JSON, CI YAML and .sh, preserved docs/hard link/alias and outside SHA/inode. Focused tests, format, format:check, lint, full test, check:changed, workflow validation passed. validate_codemod_package heuristic flags missing scripts/codemod.ts and npm/yarn scaffold mismatch despite the valid multi-step workflow and repository Yarn convention.

• Docs-only follow-up (fd43666): package-local consumer commands use yarn dlx codemod@latest run … -t … for dry-run/apply, matching Yarn 4 and feat: Backstage 1.54.0 migration - add v1.54.0 migration recipe workflow #155 recipe usage; dry-run host-shell limitation retained. yarn format:check, yarn lint, yarn test, yarn check:changed passed.

Merge Danger

Door: two-way. Revert new codemod package and changeset if needed; migration does not run on merge.

Blast Radius: targeted consumer command invocations. The host shell step scans .sh only under explicit target, skips symlinks, hard-linked .sh files (nlink > 1), docs/dependencies, and runs only during apply. Hard-linked scripts require manual review/update of every link; we do not use an unproven Windows atomic replacement or fall back to in-place writes for linked files. Concurrent filesystem mutations are outside the guarantee of the link-count check. Registry invocation from an actual published package remains a post-publication #155 E2E gate; workflow completion alone must not substitute for checking file diffs.