fix: avoid whitespace-only CIMD collision lines

[schultzp2020]

Summary

Patch published @backstage/rename-experimental-cimd-config@0.2.0 (issue #142) collision formatting without changing the recipe in draft #159. AST range().start.index counts UTF-8 bytes, but root.source() slices count JavaScript characters; a ✨ earlier in Backstage app-config.yaml shifted the insertion past the key's two-space indent, yielding a whitespace-only line. Derive line text from AST line/column, insert the block TODO at the AST key byte offset, and retain flow-pair spacing. Add a patch changeset; do not edit package/manifest versions.

Evidence

• Red: utf8-prefix-collision fixture (CRLF, preceding ✨, indented block collision) failed before fix with extra + ; utf8-flow-collision covers Unicode before a same-line flow pair. Green: package 15/15 fixtures plus workflow validation pass; existing comment, collision-idempotence, flow/block, and CRLF fixtures remain green.
• Reproduced published v0.2.0's exact feat: add Backstage 1.53.0 migration recipe (#154) #159 QA failure on disposable Backstage app-config.yaml preimage at 0863f034: git diff --check → app-config.yaml:438: trailing whitespace. Local patched shipped workflow applied to a fresh tracked disposable target: one TODO line, no whitespace-only insertion, git diff --check clean; second apply (--allow-dirty --no-interactive) byte-identical (SHA-256 31b83adc0958e7d2a15d226e251bfc5124e837b6dcf2421a2e8d3105de272cf7). No recipe override/postprocessor.
• yarn format, yarn lint, yarn test, yarn check:changed passed. Husky pre-commit ran lint-staged format/lint/package tests; normal push ran pre-push changed-file gates. git diff --check clean.

Merge Danger

Door: two-way. Independent review required before merge. Blast radius: collision-comment insertion in this one YAML codemod; key rename, non-collisions, comments, flow/block YAML, and repeat idempotence remain fixture-covered. PR #159 stays draft until this patch merges, a new Version Packages PR is manually merged by the user, and patched registry package publishes; then rerun #159 QA against the new registry version. Do not merge #159, publish manually, or treat this source-only PR as a registry release.