Give an installed machine a way to catch up

./install only ever adds. It copies over /, links dotfiles, installs
packages -- and has no way to say "remove that file", "disable that
unit", "that symlink points nowhere now". So a machine set up months
ago keeps whatever this repository has since decided was wrong, and
the only thing that ever fixes it is somebody reading a commit
message. With a curl installer in the README, that stopped being
hypothetical.

A migration is one script that performs one repair, exactly once, on
the machines that need it. Named by the commit timestamp that authored
it, so glob order is chronological without a sequence number two
branches could both pick. Marked in ~/.local/state on success and only
on success, so a repair that failed stays pending rather than being
recorded as done and hidden forever. Ordered, and stopped at the first
failure, because a later repair may assume an earlier one landed. A
fresh install marks everything without running it, the way
Migrations.qml stamps a pre-versioning settings file at its baseline.

The first real one removes the dangling ~/.config/forge symlink left
behind when the GNOME session was cut: link-dotfiles could link it but
never unlink it. Verified both ways -- a no-op on a machine that never
had it, an actual repair on one that did.

Root work goes through panama-sudo --reason so the password prompt
names the repair, and the contract fails any migration reaching for
bare sudo.

config/dot/hypr/autostart.lua

@@ -39,6 +39,11 @@ hl.on("hyprland.start", function()
     -- prompt if Panama's ever fails to come up.
     hl.exec_cmd("systemctl --user import-environment WAYLAND_DISPLAY XDG_CURRENT_DESKTOP && systemctl --user start panama-polkit-agent.service hyprpaper.service vicinae.service hypridle.service")
 
+    -- Pending repairs for this machine, if any. Oneshot: it checks, tells the
+    -- user when there is something to tell, and exits. Started here rather
+    -- than enabled so it belongs to the Hyprland session; see the unit.
+    hl.exec_cmd("systemctl --user start panama-migrate-notify.service")
+
     -- Text expansion. change-settings runs `espanso service register`, which
     -- writes and enables espanso's own user unit; the explicit start makes the
     -- first Hyprland login after a fresh install work rather than the second.