/simplify: centralize ULID minting, simplify re-stamp, single walk

Cleanups from /simplify on the migrate-to-ulid tool (quality only):

• Move timestamped ULID minting into the id package as id.GenerateULIDAt(t) (GenerateULID now delegates to it). Removes migrate_ulid.go's duplicate oklog/ulid construction and keeps ULID generation in one place; the test moves to the id package too.
• Simplify the metadata re-stamp: restampMetadataDir(repo, treeHash, sessionDir, newID) reads, patches, and grafts in one step returning the new tree hash, replacing the [][]string path list + the awkward (hash, mode, ok, error) 4-value return (unchanged trees now just return the input hash).
• Collapse the command's double walk into one: MigrateBranchHexToULIDRefs is called once with !apply. The previous dry-then-real pair walked every checkpoint twice and minted different random ULIDs, so the printed preview didn't match what got written.

Skipped (noted): hardcoded "Entire-Checkpoint: " in the sed script (stable contract; threading trailers.CheckpointTrailerKey through a format string reads worse for one-shot tooling); go-git for ref listing/deletion (deletion deliberately uses the git CLI for packed-refs correctness — see cleanup.go/ephemeral.go/common.go — and the command already requires git for filter-branch); per-session tree reads + JSON key reorder (negligible one-shot).