PO to GMP Migration Tool: Add gmp-migrate agent skill

[karthunni]

This PR introduces the gmp-migrate agent skill (cmd/gmp-migrate/SKILL.md) to guide AI coding agents through running the migration CLI, diagnosing migration reports, and safely reconciling draft GMP manifests with gmp.googleapis.com/todo-* annotations and TODO_* placeholders.

Key Highlights

• CLI Stream Separation & Modes: Documents --all vs default mode, Stdout/Stderr stream separation, and exit code semantics.
• Strict Read-Only Investigation: Enforces a strict policy where all cluster investigation commands (kubectl get, describe, logs) are strictly read-only, prohibiting unapproved live cluster mutations.
• Action Plan Catalog & Interactive Recipes:
  • Port & Selector Resolution: Guided resolution for missing backing Services, unresolved named ports, and ambiguous multi-container pods.
  • Auth & Secret Management: Ingests companion Secrets, handles base64 payload errors, and prompts for missing OAuth2/Proxy endpoints.
  • Relabeling & Scope Expansion: Interactive reconciliation for dropped keep/drop annotation rules (prometheus.io/scrape), including spec.selector intersection queries, companion workload label patches, and matchExpressions: NotIn inverted selectors.
  • Rolling Restart Safeguards: Explicitly requires warning users and requesting permission before modifying workload pod templates (spec.template.metadata.labels).
• Audit Reporting & Per-File Diffs: Mandates presenting a structured Reconciliation Audit Table and file-by-file code diffs prior to executing dry-runs or kubectl apply.

[gemini-code-assist]

Code Review

This pull request introduces a comprehensive guide (SKILL.md) for the gmp-migrate CLI tool, detailing migration execution, input discovery, and TODO reconciliation strategies. The review feedback highlights several improvement opportunities, including correcting minor typos, replacing fragile kubectl JSONPath query syntax with robust bracket notation, and updating the documentation to align with strict error-handling policies where unresolved named ports or malformed proxy URLs with credentials must trigger fatal errors instead of warnings or placeholders.

[dashpole]

It would be useful to document (or have gemini document) the steps you've taken to test this. Hosting evals in this repo might be a bit heavy-weight, but some evidence that this does what we want it to ~most of the time would be good.

[karthunni]

It would be useful to document (or have gemini document) the steps you've taken to test this. Hosting evals in this repo might be a bit heavy-weight, but some evidence that this does what we want it to ~most of the time would be good.

Created this draft PR with all our placeholder cases against an example Kind Cluster. Had subagents run the tool 5 times per test case using the tool and had an agent audit the outputted trajectories (and tried to manually review them myself). From a first glance it looks pretty consistent
#2070

[bwplotka]

Looks good, just a few nits