refactor: route SM012 through print_diagnostics; depublicize migrations helper

[antosubash]

Summary

• SM012 becomes a proper Diagnostic. check_settings_registration previously built a Diagnostic object and threw it away with logger.warning("%s", diag). It now returns list[Diagnostic] and the boot path in app_builder.py feeds it through print_diagnostics, so the warning renders with the same framing as every other SM-code.
• _migrations.py → migrations.py. Two conftests (conftest.py, modules/users/tests/conftest.py) already import resolve_head_revision across the package boundary, so the leading underscore was signalling something that wasn't true. The other _*.py files in simple_module_hosting genuinely are intra-package and stay underscored.
• CLAUDE.md drift. Two fixes:
  • The per-module-settings convention line said app.state.<module>_settings. That hasn't been true since the 2026-04-17 app.state reorganization (commit 04b133f) — current convention is app.state.<module_lower>, which is also what SM012 checks for.
  • The diagnostic-code summary skipped SM007 (emitted by ModuleDiagnostics) and SM012 (emitted here). Both added.

Why

Came out of an architecture audit that started from a sprawl complaint ("6 registries, 16 diagnostic codes, 10 hooks"). Most of the claims reversed under scrutiny — versioning.py guards ABI compat at boot, health.py feeds /health/ready, the "unused" lifecycle hooks are wired extension points per recently-landed specs, and the 3-package split has a clean linear dep graph. The two genuine findings are in this PR.

What's explicitly not in this PR and why:

• Deleting versioning.py / health.py — both are load-bearing (boot gate + /health/ready respectively), just zero module overrides today.
• Removing lifecycle hooks (template_dirs, static_mounts, register_event_handlers, register_exception_handlers, on_shutdown) — all wired end-to-end and backed by a landed design doc; removing them is a product decision, not cleanup.
• Merging the 3 framework packages or renaming the rest of the _*.py files — no real sprawl; the split is principled, and the remaining underscore files are only consumed within simple_module_hosting.

Test plan

• make test-py — 562 passed, 4 deselected
• uv run ruff check framework/ — clean
• Framework test subset (framework/hosting/tests/test_app.py, framework/core/tests/) — 152 passed
• Visual confirmation (future): boot a module that overrides register_settings without touching app.state.<module> in dev mode; SM012 should now render with the diagnostic header instead of a bare warning log line

Reviewer notes

• There are now two print_diagnostics calls at boot (phase 2, phase 4). SM012 requires register_settings to have run first, so it can't fold into the phase-2 pass without reordering fail-fast semantics. Considered and skipped — cost is one extra header print when SM012 fires.
• The if settings_diagnostics: guard in app_builder.py is intentional: print_diagnostics logs "No issues found" on empty input, and we already emit that in phase 2.