This adds a way to opt specific codemods out of gh aw fix and gh aw upgrade. The change is scoped to codemod selection: callers can now suppress individual migrations by codemod ID, and invalid IDs fail fast.

• CLI surface

  • Add repeatable --disable-codemod to gh aw fix
  • Add repeatable --disable-codemod to gh aw upgrade
  • Preserve existing behavior when the flag is not provided

• Codemod selection

  • Introduce filtered codemod resolution instead of always applying the full registry
  • Exclude only the requested codemod IDs
  • Return a clear error for unknown codemod IDs rather than silently ignoring them

• Command wiring

  • Thread disabled codemod IDs through FixConfig and the upgrade flow
  • Ensure upgrade passes exclusions into its internal fix step

• Coverage

  • Add focused tests for:
    • flag registration on both commands
    • codemod filtering behavior
    • unknown-ID rejection
    • end-to-end skip behavior for a disabled codemod

Example:

gh aw fix --write \
  --disable-codemod timeout-minutes-migration \
  --disable-codemod network-firewall-migration

gh aw upgrade \
  --disable-codemod serena-tools-to-shared-import