An agent that does the migration nobody wants to do, one file at a time. The test suite decides what gets kept.
Run the migration, then pick a file to see what changed.
The agent reads one file and its tests, then writes a replacement. It never sees the rest of the repo, and it cannot reach the network or the filesystem outside the project.
The file's own test suite runs against the proposal. The agent does not get to report success. If the tests fail, the failure text goes back to it and it tries once more.
Green tests, the change is kept. Still failing after the retry, the file is put back exactly as it was and flagged for a person, with the reason attached.