feat(cli): omnigraph config migrate — the RFC-008 split (stage 2)

Reads a legacy omnigraph.yaml and produces the three-section split: team
half as a ready-to-review cluster.yaml proposal (graphs with TODO schema
pointers — the legacy file never knew schemas — per-graph queries
directories, policies with applies_to bindings), personal half as an
operator-config merge (actor, output/table defaults — OperatorDefaults
gains the two table keys with their cascade hops — remote graphs with
bearer_token_env become servers entries plus a printed login step, and
legacy aliases split per the RFC: content to the catalog as a manual
step, binding to an operator alias), plus a dropped-keys section with
reasons. Touches nothing without --write; with it, the operator merge is
key-level (existing entries always win; prior file backed up), and
cluster.yaml is emitted only when absent (else cluster.yaml.proposed).
--json emits the report structurally.

The completeness contract is a unit test: every top-level key of the
legacy schema must classify somewhere, or the RFC-008 map has a bug.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/omnigraph-cli/src/cli.rs

@@ -56,6 +56,12 @@ pub(crate) enum Command {
         #[arg(long)]
         json: bool,
     },
+    /// Legacy-config tooling (RFC-008): split omnigraph.yaml into its
+    /// two destinations.
+    Config {
+        #[command(subcommand)]
+        command: ConfigCommand,
+    },
     /// Remove a named server's stored credential. Idempotent.
     Logout {
         name: String,
@@ -681,3 +687,20 @@ impl CliLoadMode {
     }
 }
 
+#[derive(Debug, Subcommand)]
+pub(crate) enum ConfigCommand {
+    /// Propose (and with --write, apply) the RFC-008 split of a legacy
+    /// omnigraph.yaml: team half -> a ready-to-review cluster.yaml,
+    /// personal half -> ~/.omnigraph/config.yaml (key-level merge,
+    /// existing entries always win). Touches nothing without --write.
+    Migrate {
+        /// Path to the legacy omnigraph.yaml (default: ./omnigraph.yaml)
+        #[arg(long)]
+        config: Option<PathBuf>,
+        /// Apply the split instead of only printing it
+        #[arg(long)]
+        write: bool,
+        #[arg(long)]
+        json: bool,
+    },
+}