feat(cli): add migrate planning command

[nucleuskit]

Summary

Adds nucleus migrate as a first-class CLI subcommand for version migration planning and readiness checks.

The command now follows the established CLI package shape used by report, scenario, and verify: root only wires the command, while cmd/nucleus/internal/migrate owns flags, execution, typed output, report writing, diagnostics, and tests.

Motivation / Why

The previous migrate logic was too thin for a large open-source project: it lived in root.go, returned an ad-hoc map, and produced a generic suggested-edit list that did not behave like the rest of the CLI.

This PR turns it into an auditable, contract-first migration planning command that can be consumed by humans and automation without mutating service code.

Affected Areas

• cmd/nucleus/internal/migrate: new command package with command.go, run.go, output.go, paths.go, constants, package docs, and command tests.
• cmd/nucleus/internal/root: thin command wiring plus root-level migrate wiring test.
• docs/concepts/migrate-command.md: public command behavior and output contract docs.
• contract submodule pointer: updated to a contract main commit that contains contract/schema/migrate.schema.json.

Behavior / Output Contract

• Adds required inputs: --from-version and --to-version.
• Adds command options consistent with sibling commands: --json, --pretty, --check, and --report.
• Emits a stable JSON envelope:
  • result_kind: nucleus.migrate_result
  • schema_version: migrate.v1
  • schema_ref: contract/schema/migrate.schema.json
  • ok, mode, summary, diagnostics, and migration.
• --check converts readiness failures into diagnostics and a non-zero exit path.
• --report writes the same JSON envelope only when the target path resolves inside the service directory.
• The command is report-only and does not rewrite service code, call provider SDKs, or contact a control plane.

Compatibility

This is additive CLI surface area. Existing commands and public Go APIs are not changed.

The migration rules intentionally remain CLI-internal for now. The PR does not add a public contract/migration package or expand contract module API surface.

Validation

• rtk go test ./... from repository root: 121 passed in 17 packages.
• rtk go test ./... from contract: 93 passed in 10 packages.
• rtk go run ./cmd/nucleus migrate --dir example/hello-http --from-version v0.1.0 --to-version v0.2.0 --check --json --pretty: emitted ok: true with 6 checks and 0 diagnostics.
• rtk go run ./cmd/nucleus verify --dir example/hello-http --json: 7/7 verification steps passed.

Review Notes / Residual Risks

• The current rule table is conservative and supports known forward paths plus a generic forward checklist. Future version-specific transformations should remain explicit and tested.
• migrate is intentionally not an auto-upgrader; service owners still apply edits through the normal describe -> plan -> gen -> lint -> verify loop.
• Local workspace still contains unrelated dirty submodule state for bridge, cap, and core; these are excluded from the PR compare.