fix-heredoc-install.sh and fix-todo-markers.sh report but do not fix, yet are routed as auto_execute fixers #646

What

Two scripts registered as fixers don't remove what their recipes claim to remove.

scripts/fix-heredoc-install.sh (recipe-heredoc-to-install):

• For curl … | sh, it only adds a # WARNING: Pipe-to-shell is unsafe comment above the line.
• eval $(…) and eval $VAR are only reported (FOUND …); nothing changes.

scripts/fix-todo-markers.sh (by_category: TodoMarkers; recipe-todo-to-fill has no by_recipe entry): it counts TODO/FIXME/HACK/XXX markers and changes nothing. FIXED_COUNT counts files found, not fixed.

Why it matters

Under the predicate verdicts from #616/#622, a fixer is judged by whether its targets are gone. A --check predicate for these two would read incomplete on every run with targets, and on the code as written that is the correct verdict. In the E1 outcome log they account for 4,695 "success" rows (2,863 + 1,832). Those rows were written by robot-repo-automaton, not by these scripts, so they are unverified either way.

I didn't add predicates in #645, because a predicate that always reads incomplete adds no information. The open question is how to classify these scripts.

Options

1. Reclassify as report-only (recommended). Move both out of the auto_execute routing into report/review. Rename the heredoc recipe to what it does (for example recipe-annotate-pipe-to-shell), as recipe-remove-believe-me became recipe-annotate-believe-me. Then add a --check predicate that counts only unannotated pipe-to-shell lines, which that script can actually discharge.
2. Make them real fixers. Converting eval/curl | sh safely is not mechanical, so this probably needs Substitute-tier review.
3. Leave as is. Document that they are reporters, and accept that dispatch will count them as failed once predicates exist.