feat(cli): omnigraph config migrate — the RFC-008 split (stage 2)

Reads a legacy omnigraph.yaml and produces the three-section split: team
half as a ready-to-review cluster.yaml proposal (graphs with TODO schema
pointers — the legacy file never knew schemas — per-graph queries
directories, policies with applies_to bindings), personal half as an
operator-config merge (actor, output/table defaults — OperatorDefaults
gains the two table keys with their cascade hops — remote graphs with
bearer_token_env become servers entries plus a printed login step, and
legacy aliases split per the RFC: content to the catalog as a manual
step, binding to an operator alias), plus a dropped-keys section with
reasons. Touches nothing without --write; with it, the operator merge is
key-level (existing entries always win; prior file backed up), and
cluster.yaml is emitted only when absent (else cluster.yaml.proposed).
--json emits the report structurally.

The completeness contract is a unit test: every top-level key of the
legacy schema must classify somewhere, or the RFC-008 map has a bug.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

crates/omnigraph-cli/tests/cli_schema_config.rs

@@ -538,3 +538,74 @@ fn legacy_config_load_warns_per_key_and_suppression_silences() {
     let stderr = String::from_utf8_lossy(&output.stderr);
     assert!(!stderr.contains("deprecated (RFC-008)"), "{stderr}");
 }
+
+/// RFC-008 stage 2: `config migrate` proposes the split read-only, applies
+/// it with --write (operator merge never clobbers; cluster.yaml emitted),
+/// and a second --write is idempotent.
+#[test]
+fn config_migrate_splits_legacy_config() {
+    let temp = tempdir().unwrap();
+    fs::write(
+        temp.path().join("omnigraph.yaml"),
+        "graphs:\n  prod:\n    uri: https://graph.example.com\n    bearer_token_env: PROD_TOKEN\ncli:\n  actor: act-me\n  output_format: json\npolicy:\n  file: ./top.policy.yaml\n",
+    )
+    .unwrap();
+    let operator_home = tempfile::tempdir().unwrap();
+    fs::write(
+        operator_home.path().join("config.yaml"),
+        "operator:\n  actor: act-existing\n",
+    )
+    .unwrap();
+
+    // Read-only proposal: names both halves, writes nothing.
+    let output = cli()
+        .current_dir(temp.path())
+        .env("OMNIGRAPH_HOME", operator_home.path())
+        .env("OMNIGRAPH_SUPPRESS_YAML_DEPRECATION", "1")
+        .arg("config")
+        .arg("migrate")
+        .output()
+        .unwrap();
+    assert!(output.status.success(), "{output:?}");
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    assert!(stdout.contains("team half -> cluster.yaml"), "{stdout}");
+    assert!(stdout.contains("operator.actor: act-me"), "{stdout}");
+    assert!(stdout.contains("omnigraph login prod"), "{stdout}");
+    assert!(!temp.path().join("cluster.yaml").exists());
+
+    // --write: cluster.yaml lands; the existing operator actor is KEPT.
+    let output = cli()
+        .current_dir(temp.path())
+        .env("OMNIGRAPH_HOME", operator_home.path())
+        .env("OMNIGRAPH_SUPPRESS_YAML_DEPRECATION", "1")
+        .arg("config")
+        .arg("migrate")
+        .arg("--write")
+        .output()
+        .unwrap();
+    assert!(output.status.success(), "{output:?}");
+    let cluster = fs::read_to_string(temp.path().join("cluster.yaml")).unwrap();
+    assert!(cluster.contains("version: 1") && cluster.contains("  prod:"), "{cluster}");
+    let operator_text =
+        fs::read_to_string(operator_home.path().join("config.yaml")).unwrap();
+    assert!(operator_text.contains("act-existing"), "{operator_text}");
+    assert!(!operator_text.contains("act-me"), "existing keys win: {operator_text}");
+    assert!(operator_text.contains("output: json"), "{operator_text}");
+    assert!(
+        operator_text.contains("url: https://graph.example.com"),
+        "{operator_text}"
+    );
+
+    // Second --write: cluster.yaml exists -> proposal file, no clobber.
+    let output = cli()
+        .current_dir(temp.path())
+        .env("OMNIGRAPH_HOME", operator_home.path())
+        .env("OMNIGRAPH_SUPPRESS_YAML_DEPRECATION", "1")
+        .arg("config")
+        .arg("migrate")
+        .arg("--write")
+        .output()
+        .unwrap();
+    assert!(output.status.success(), "{output:?}");
+    assert!(temp.path().join("cluster.yaml.proposed").exists());
+}