feat(migration): migrate legacy owner data and update config reference handling

- Implemented a migration process to move resources from the legacy owner "default" to the new default owner "local", ensuring no data loss during the transition.
- Updated configuration reference handling to replace legacy `$VAR_`, `$SECRET_`, and `$CONTEXT_` prefixes with mustache-style `{{ vars.name }}`, `{{ secrets.name }}`, and `{{ context.name }}`.
- Enhanced YAML configuration files and scripts to reflect the new mustache syntax, improving consistency across the application.
- Added tests to validate the migration process and ensure proper handling of legacy references.
- Updated documentation to guide users on the new configuration reference format.

packages/server/test/owner-migrate-smoke.js

@@ -0,0 +1,30 @@
+import { rewriteLegacyConfigRefsInText } from "../config-ref-rewrite.js";
+import { migrateDefaultOwnerIfNeeded } from "../owner-migrate.js";
+import { migrate, db } from "../db.js";
+
+function assert(cond, msg) {
+  if (!cond) throw new Error(msg);
+}
+
+{
+  const { text, changed } = rewriteLegacyConfigRefsInText(
+    "a: $VAR_x\nb: $SECRET_y\nc: $CONTEXT_z\nd: passwordSecret: gmail_app",
+  );
+  assert(changed, "detects legacy");
+  assert(text.includes("{{ vars.x }}"), "var rewrite");
+  assert(text.includes("{{ secrets.y }}"), "secret rewrite");
+  assert(text.includes("{{ context.z }}"), "context rewrite");
+  assert(text.includes("passwordSecret: gmail_app"), "bare secret name untouched");
+}
+
+await migrate();
+const first = await migrateDefaultOwnerIfNeeded();
+const second = await migrateDefaultOwnerIfNeeded();
+assert(second.secrets.moved === 0, "second pass moves no secrets");
+assert(second.runs.moved === 0, "second pass moves no runs");
+await db.destroy();
+
+console.log("owner-migrate smoke passed", {
+  firstSecretsMoved: first.secrets.moved,
+  secondSecretsMoved: second.secrets.moved,
+});