Isolate legacy issue migration with reporting queue lanes

Implementation authorized and started. No production deployment or backlog migration is authorized by this implementation request. Scope spans engines PRK.Reporting/PRK.Reporting.Workflow/portal schema and the sibling player-reporting-worker deployment. Outcome: run a second player-reporting-worker instance with independent writable openai-codex authentication, analyzer credentials, schedule and concurrency while sharing the existing workflow coordinator, database, delivery/executor and audience-aware catalogue. Normal model workers must never claim migration reports, including explicit report-ID selection; migration workers must never claim normal reports. Lanes are scheduling metadata, not privacy/authorization boundaries. Implemented design: persist a constrained QueueLane (default or migration) on BugReport. Portal submissions and existing rows default to default; new legacy imports use migration server-side, without caller-controlled lane selection. Keep lane stable across retry/retriage/recategorization; preserve import identity/fingerprint/retry semantics. Do not infer existing imported rows from prose or automatically move active/completed rows; any existing-import reassignment needs a deliberate reviewed operation. Add additive schema migration, EF mapping/indexes and coordinator schema readiness validation. Claim and preview accept an optional validated lane, defaulting to default for old callers. Apply the lane predicate together with reportId before selection and within the existing locking/lease path; preserve lane on recursive skip. Invalid lanes fail closed. No all-lanes wildcard or fallback. Reuse leased proposal/evidence APIs and existing job/proposal contracts: the LLM does not choose a lane. Add capability/readiness negotiation so migration workers refuse an older coordinator that might ignore the lane parameter. Worker: validated queueLane config shared by normal, targeted, preview and dry-run paths; omitted config means default. Independent named Compose project/env/config/model-auth/token/lock/scheduler paths. Refactor existing hardcoded wrappers only as needed; avoid accidental shared auth, deployment receipts, image-tag activation or auth-install targets. Existing production scripts assume one deployment. Implementation uses engines branch feature/reporting-queue-lanes in /home/mathias/Projects/engines and worker branch feature/reporting-queue-lanes in /home/mathias/Projects/worktrees/player-reporting-queue-lanes, based on fetched worker origin/main 65ed56b (v5). Original worker checkout/worktrees remain untouched. Committed under explicit PR-opening authorization: engines 0921fc850 (feature: Isolate legacy imports with reporting queue lanes) and worker 9bd9e82 (feature: Support independent migration worker instances). Both feature/reporting-queue-lanes working trees are clean. No production changes. Backend implementation includes strict lanes, migration 011/readiness and ten default plus configurable two migration delivery/execution allocations; MigrationEnabled=false pauses new migration claims/delivery/execution. Worker has capability checks and independently parameterized run/auth/deploy paths, project/image tags and state. Final validation: broad PlayerPortal .NET suite 240 passed, 3 pre-existing trade SQL/browser skips, zero failures; real SQL Server covers additive migration/backfill/constraint/readiness, query translation and concurrent lane leases. Worker npm test: 36 Node and 18 Python tests passed, including capability refusal and independent run/auth/deploy paths and auth installation. New local/lanes-check.mjs acceptance passed against isolated real SQL, Forgejo, portal and coordinator with two deterministic analyzers: newer normal report progresses with migration stopped; targeted lane filtering and non-mutating dry run hold; wrong analyzer token is rejected; migration resumes and all six decisions publish. Docker image build tests also pass. Static engines review found only a v3 test-fixture content problem, corrected and verified. Syntax and git diff checks pass. Acceptance stack removed its own containers/volumes and left existing local stack unchanged. It uncovered local coordinator port 5060 being blocked by Node Fetch; local-only URL/listen/health configuration now uses 5062. Production config unchanged. No live Codex-provider, production rollout, or full-solution test claim; these are outside this implementation validation. Validation logs: /tmp/reporting-lanes-npm-final.log, /tmp/reporting-lanes-stack.log, /tmp/reporting-lanes-dotnet-final.log. Documentation covers migration 011 rollout and pre-lane rollback hazard. Publication completed after the user authorized retry and the configured SSH agent worked. Both committed branches are pushed with upstream tracking. Open, cross-linked PRs: engines #2824 — https://git.project-rk.com/prk/engines/pulls/2824 (feature/reporting-queue-lanes → develop); player-reporting-worker #9 — https://git.project-rk.com/prk/player-reporting-worker/pulls/9 (feature/reporting-queue-lanes → main). No merge or production deployment performed. Worker npm test rerun passed 36 Node and 18 Python tests. Engines merge-tree against fetched develop 93824345e was conflict-free; the merged result was not executed. Original implementation validation remains as recorded above; its /tmp logs are no longer present. Protect shared stages: bounded player-first delivery and decision execution with a small bounded migration allocation per tick, reusing current services/leases and respecting retries/reconciliation. Pause/throttle migration without stopping default reports. Shared Forgejo/database/publication still have finite capacity: lanes do not promise physical isolation or preemption of an in-flight request. Keep duplicate search cross-lane within existing audience/privacy rules. No new broker, coordinator, schema-per-lane, catalogue partition or model-side routing. Acceptance and validation: default caller excludes migration; migration selection excludes default; explicit IDs cannot bypass lanes; invalid lane rejected; preview/dry-run never claim; concurrent workers do not double claim; expired leases/retries/retriage/product changes preserve lane; import retries unchanged; audience-scoped duplicate checks still cross lanes. Verify additive SQL migration/defaults/indexes/readiness on real SQL Server and focused .NET/worker tests. Full-stack test seeds migration backlog and a later player report, runs independent worker instances/auth directories and checks lane-specific model claims, bounded shared-stage prioritization, migration pause and resumption, and normal report progress. Source inspection alone is not deployment validation. Rollout: pause model runs; deploy portal additive migration, coordinator with lane/capability support, then compatible workers. Smoke-test both lanes before bulk imports; throttle import batches and avoid per-row ticks. Never roll back to a pre-lane coordinator with pending migration work while ordinary workers are running; that coordinator would consume all rows. Actual backlog fetching, transformation/import run and production credential provisioning are separate operational work.