feat(migrations): emit pending plans as JSON

[tang-vu]

Summary

• add migrate-config.sh check --json with current and last-migrated versions
• include ordered pending migration versions and descriptions
• preserve exit code 2 when a migration is required and exit 0 when current
• keep existing human output unchanged

Why this matters

Upgrade orchestration already calls the read-only migration check before applying configuration changes. A structured plan lets installers and fleet tooling display exactly what is pending without scraping ANSI-formatted output or performing a backup/mutation.

Overlap check

Searched open and closed PRs for migration check json and PRs referencing ods/scripts/migrate-config.sh. Open PRs #3548/#2830/#3533/#2449/#2393/#2954/#2478/#3382/#3075/#1949 address quoting, semver, backup, or atomic state writes; none exposes a JSON check plan. This PR does not change migration execution or persistence.

Test plan

• bash ods/tests/test-migrate-config.sh (16 checks)
• bash -n ods/scripts/migrate-config.sh
• git diff --check -- ods/scripts/migrate-config.sh ods/tests/test-migrate-config.sh

Tradeoffs and rollback

The JSON option requires jq, which is already used by version parsing in this tool. Removing the optional reporting branch restores the previous CLI; migration selection and exit-code semantics remain intact.

Generated with Codex

Batch compatibility

• Independently mergeable; tested combined in order feat(mode): emit routing status as JSON #3657 → feat(bootstrap): list hosted verification endpoints #3666.
• Base: upstream/main@6ff9b4fc; synthetic integration head: e45e2647.
• All focused public-boundary suites, the canonical generated-config JSON scan (12 surfaces), make lint, and git diff --check upstream/main...HEAD passed.
• tests/test-installer-context-parity.sh still fails at Hermes template bounds each model turn; the identical failure was reproduced on the exact upstream base, so it is not introduced by this batch.
• No live Docker mutation, model activation, migration, hosted deployment, or hardware validation is claimed.