chore: add toolkit settings migration

[BYK]

Adds one-off migration tooling for the Toolkit move into getsentry/sentry-mcp.

Settings workflow security properties:

• runs only through workflow_dispatch from the source default branch and pins both repositories by numeric ID
• uses permissions: {} and never checks out or executes repository code
• reads the short-lived destination-admin PAT only from SENTRY_MCP_MIGRATION_PAT, never from workflow inputs
• fails before writing if any source value is missing
• copies explicit repository and production environment settings without printing values
• recreates and verifies the protected-branch production environment policy
• verifies destination names and metadata after writing

Open-PR migration tooling:

• defaults to a read-only plan and requires the reviewed plan for execution
• pins source PR metadata, immutable pull refs, source targets, filtered import tips, destination bases, reconstructed commits, and exact mapped diff hashes
• supports stale roots and stacks, forks, historical pre-monorepo paths with explicit verified lineage, and merge-containing PR histories
• verifies path, mode, blob, metadata, branch, and PR state; resumes only recognized exact phases
• revalidates live source targets and destination bases immediately before every GitHub write, including skipped stack ancestors
• creates branches atomically with must-not-exist leases and never closes source PRs
• stops until the filtered CLI and docs import tips are present on destination main

Validation:

• 22 deterministic migration tests pass
• Node module checks, Biome formatting/lint, and git diff --check pass
• four independent review rounds resolved stale-base, historical-lineage, merge, recovery, collision, metadata, reproducibility, and target-drift defects; the final frozen artifact passed

After a successful settings run, delete SENTRY_MCP_MIGRATION_PAT, revoke the PAT, and remove the workflow. Review the generated open-PR migration plan before any execution.

Part of #1239.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
cli	Ready	Preview	Sep 18, 2026 9:48pm UTC
sentry-local	Ready	Preview	Sep 18, 2026 9:48pm UTC

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c344c23. Configure here.}