Provision the independent legacy migration worker

Provision an independent migration worker on git-prk-server using the user-generated ~/.local/share/prk-migration-pi/auth.json. Keep normal worker, existing auth, scheduler and running containers untouched. No backlog imports or recurring migration schedule are authorized yet. Use isolated /opt/player-reporting-migration checkout, /etc/prk-reporting-migration.env, /srv/prk-reporting-migration configuration/analyzer token/writable auth, prk-reporting-migration Compose project, independent lock and deployment receipt. Reuse the existing filtered source snapshot read-only and configured production model unless a compatibility check fails. Transfer auth without printing credentials or committing them. Rollout prerequisites are now verified after user confirmation: worker main is 2d6948a (merged PR #9); coordinator workflow_v0.1.3 is ready, contract v5, and advertises default/migration lanes. Proceed with updating/building the isolated instance and starting its analyzer only. Do not merge PRs or alter the normal pipeline under this request. Provisioned on git-prk-server: root-owned clean /opt/player-reporting-migration checkout fast-forwarded to merged main 2d6948a58a04f8db24833908a87897158377146b. Independent analyzer/controller images built successfully, including image-build tests. Local clone uses --no-local plus the existing worker's exact scoped remote.origin.uploadpack configuration to trust only the known Forgejo bare repository; global Git trust unchanged. Independent /etc/prk-reporting-migration.env points to /srv/prk-reporting-migration/config/worker.json, independent analyzer-token and /srv/prk-reporting-migration/model-auth. Auth transferred over configured-agent SSH stdin through the candidate's validated standalone installer /usr/local/libexec/prk-reporting-migration-install-auth.py. Credential/config/token UID 1000 mode0600, auth dir0700; auth accountId verified different from normal without logging identities or tokens. queueLane=migration, maxBatch=4, model inherited gpt-5.6-terra and read-only source snapshot shared with default worker. Workflow bearer shared as designed; analyzer token is distinct. Manual guarded /usr/local/sbin/prk-reporting-migration accepts check/triage/triage-dry-run. It requires lane-aware main checkout, then reuses deployment read-only readiness/impossible-ID preview before any run. Installed static prk-reporting-migration.service remains manual-only/inactive; no timer. Only prk-reporting-migration-analyzer-1 is running, with no published host ports; code snapshot and analyzer token mounts are read-only, dedicated auth mount is writable and verified inside UID1000 container. Guard passes coordinator workflow_v0.1.3 lane capability and authenticated impossible-ID preview. No actual report claims, submitted proposals or imports. Default env/config/auth/token hashes, running analyzer ID/image/start timestamp, and timer state matched the pre-provisioning baseline; existing pipeline untouched. Baseline and prepared-state metadata are private under /srv/prk-reporting-migration. Activation verified: analyzer sha256:e1bf3a7113cffe3d397273a669bc8496b7690a4550a10fe09e3653e4372c474a; controller sha256:9b189527ba43b01552c629b77ef786a95296241bd0ae4cfe6326e553b66b6860. Dedicated deployment receipt /var/lib/prk-reporting-migration-deploy/state.json and /srv/prk-reporting-migration/provisioning.json record exact revision/images. Source snapshot shared read-only with normal worker: f60c1d59aa4fc24ca83a55f91aaabd6e0bccc342:3677f47e5d569c747a950a2d9e48b8036a07e5d1af374823c41e17cd00378c6e (5149 files). This is the existing production snapshot, not newly refreshed here. Real dedicated-account/model access passed one bounded synthetic request sent directly to the analyzer (all-zero synthetic report/lease IDs, no player data/evidence, no workflow claim or proposal endpoint). gpt-5.6-terra returned a valid uncertain/bug proposal; nothing was submitted or published. Credential/source readiness, writable dedicated auth, independent mounts/no host port, and final lane preflight all pass. Normal env/config/auth/token hashes, analyzer ID/image/start time and timer state remain equal to the pre-provisioning baseline. Migration runtime is ready for manual batches; actual import preparation/runs and recurring scheduling remain outside this authorization. Build log is private /srv/prk-reporting-migration/build.log. No repository edits or production normal-pipeline restart performed. Acceptance: separate paths/project/tokens/auth verified without exposing secrets; root-controlled manual wrapper/service with no enabled recurring timer; lane readiness and impossible-ID preview verified before activation; analyzer credential/source health verified, optional tightly bounded synthetic provider check without claiming player reports; no imports or actual report claims. Record exact code/image/source revisions and remaining rollout prerequisites. On SSH/auth/connectivity/timeout errors stop and ask user; no authentication fallback.