fix(bin): safely unregister custom checks

[dnth]

Custom watcher checks had no dedicated retirement path, which made hand-composed removals easy to aim at the wrong state path. This ports upstream PR kunchenguid#3369 and adds one guarded command that validates the state directory and task id before removing only the named check and trust pair.

What changed

• Added bin/fm-check-unregister.sh with the same single-link and same-device safeguards used by teardown.
• Documented unregister and teardown as the only retirement paths, and added the command to the script inventory.
• Added executable regression coverage for invalid input, missing or empty state paths, scoped removal, hard links, and symlinks.

What I did not change

The watcher, teardown cleanup flow, OMP adapters, OMP spawn and verification, and OMP wake or arm code are unchanged.

For reviewers

Suggested reading order: bin/fm-check-unregister.sh, tests/fm-check-unregister.test.sh, then the small ownership and test-runner updates.

The remote head is the No-Mistakes rebased form of local commit 69f28fb; both commits have patch ID f08f9d0c06593879e50e33318e3f201fa6851ee4. No-Mistakes review, tests, documentation review, and lint completed with zero findings before its known internal push-mirror defect.

Validated with:

• tests/fm-check-unregister.test.sh
• bin/fm-test-run.sh tests/fm-check-unregister.test.sh
• bin/fm-lint.sh
• bin/fm-doc-audience-check.sh
• tests/fm-omp-harness.test.sh