Manually deploy ten-minute retries to the migration worker

User confirms the coordinator is live after worker PR #10 merged and requests continuation of the manual migration-worker rollout. Do not add CD, import more issues, start report processing or enable continuous scheduling. Verified prerequisites: coordinator workflow_v0.1.4 is ready, v5, advertises queueLanes and providerDeferral=true; bare worker main b3aa84c contains merged retry changes. Migration checkout clean at2d6948a, only analyzer running, no timer and no saved provider-retry.json. Use isolated project/config/lock/state paths from provisioning. Deploy merged main with the existing tested deploy helper's image staging/readiness/rollback logic, installing a root-owned migration-specific helper outside checkout if needed. Preserve dedicated Codex credentials/source snapshot and current batch4 configuration. Update manual wrapper/service to permit continuous mode safely but leave it inactive/unscheduled. Verified and deployed merged worker main b3aa84c57993e4ad3cdbca32ae34f07ce3662d7a using /usr/local/libexec/prk-reporting-migration-deploy.py, installed root-owned outside checkout from merged main. Used explicit PRK_REPORTING_* migration repo/env/lock/state settings; no CD workflow/router/secrets added. Tested deploy helper staged both images and recreated only migration analyzer, completed readiness and atomic receipt successfully. Deployment log /srv/prk-reporting-migration/deploy-b3aa84c57993.log; receipt /var/lib/prk-reporting-migration-deploy/state.json. Analyzer image sha256:4d29d10638e36e3d06cce1e52c5167c69ece234236954599b7c8004b95b93dd4; controller sha256:989696b53061a89e24ba0ab7db08a77a02de243a2f707326fb06c10e6df80791. Checkout clean on main. Runtime verification: coordinator workflow_v0.1.4 ready with providerDeferral=true/default+migration lanes; authenticated impossible-ID preview passes. Deployed analyzer provider-retry constant is600000ms, health200, authenticated /provider-state returns null; unauthenticated provider-state is401. Nonexistent all-zero report deferral safely returns409 without touching any real lease/report. Dedicated auth remains readable/writable inside container and code read-only; source snapshot unchanged f60c1d59aa4fc24ca83a55f91aaabd6e0bccc342:3677f47e5d569c747a950a2d9e48b8036a07e5d1af374823c41e17cd00378c6e (5149files). No host ports. No model calls, quota exhaustion checks, imports or actual report claims made. Manual controls: root wrapper now accepts triage-continuous; service changed to Type=simple/TimeoutStartSec=0/ExecStart wrapper triage-continuous. Backups under /srv/prk-reporting-migration/controls-before-retry-rollout; Python compile and systemd-analyze verify pass. Service remains static and inactive, no timer. Only migration analyzer running; no controller launched. Both workers config/token/auth file hashes exactly match this rollout's private baseline. Normal analyzer independently rolled out through its own CD to b3aa84c during this work; migration commands did not modify it. Migration config remains lane=migration, maxBatch4. Final provisioning metadata updated under /srv/prk-reporting-migration/provisioning.json. Continuous processing remains awaiting user authorization. Normal pipeline may independently deploy concurrently; distinguish its own deployment receipt from migration changes. Never expose secrets or bypass configured SSH agent. Stop on remote connectivity/auth/timeout problems; no automatic rerun after timeout.