refactor(bin): collapse fm-pr-check-migrate legacy classifier into one function

[harmeet-1337]

Summary

Implements accepted simplification-audit finding F-S09-2 (P0): the legacy-check classification loop in bin/fm-pr-check-migrate.sh was written four times.

• current_checks_authenticated and unsafe_checks_absent were byte-identical.
• migration_needed was the same loop, negated.
• The main migration loop repeated the classification preamble a fourth time.

Change

Introduce one classify_check <path> that evaluates a check file in today's exact order — valid X-mode shim, then registered custom check, then canonical PR poll (fm_pr_poll_artifacts_valid), else legacy — and prints exactly one of x-shim|custom|poll|legacy. Then:

• current_checks_authenticated scans for any legacy check via the classifier.
• unsafe_checks_absent is a one-line alias of it (both names kept because callers use each).
• migration_needed is its negation.
• The main migration loop dispatches on the classifier.

Behavior is byte-identical: same outputs, diagnostics, and exit codes. The classifier runs the three validators in a command-substitution subshell, which is safe because they are read-only predicates whose globals the callers do not consume (the main loop recomputes canonical metadata via metadata_pr_is_canonical).

Tests

Adds one tests/fm-pr-check-security.test.sh case that seeds all four check kinds in one state dir and asserts only the legacy one is quarantined. Full suite passes (37 ok) and shellcheck 0.11.0 is clean.

Validation

Validated through the no-mistakes pipeline: intent, rebase, review (0 findings), test (passed), document (no changes), and lint all green. The pipeline injected no commits; this PR contains only the single authored commit. Delivered via fork because the pipeline's push to upstream returned 403 (read-only on upstream); the lint step's local "ShellCheck not found" was an environment gap in the pipeline runner, not a code issue.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge with no actionable regressions identified.

The centralized classifier preserves the former evaluation order, identifiers, predicates, and return behavior, while the added test covers all four classifications together.

_{Reviews (1): Last reviewed commit: "refactor(bin): collapse fm-pr-check-migr..." | Re-trigger Greptile}