[G20] Pilot migration with reversible legacy runner handoff

[jjangg96]

Goal

Demonstrate a reversible rollout from existing manual runners to gh-runnerd-managed pools across both organizations without accidental interruption or resource adoption.

Create one active Codex goal from the statement above when this issue is dispatched. The Project Goal field is a work specification; it does not start an agent. Do not invent a token budget.

Execution contract

Field	Value
Goal key	G20
Stage	M4 - Pilot and release
Initial status	Backlog
Primary agent	gpt-5.6-luna / max
Priority / risk	P1 / High
Test profiles	offline, trusted-runtime, trusted-live-github

Use one issue branch/worktree and one focused PR. Independent Luna max review is required for authentication, protocol, concurrency, resource ownership, cleanup or service identity boundaries; other changes need independent contract review. Model fields are routing instructions, not GitHub user assignments.

Dependencies

• G17 #17
• G18 #18

Dependencies must be Done before implementation begins. A new issue is not blocked simply because its future evidence has not been collected.

Scope

Runbook and operator-authorized canary rollout. Existing manual services remain until canary success; no unattended production rewrite.

TDD and failure evidence

1. Red: migration checks detect workflow labels still targeting the wrong pool or a missing access grant.
2. Move one reviewed test workflow first, then expand; verify rollback can route back to old runners.
3. Drain old owned-by-operator services only in the explicit handoff procedure after busy work completes.

Capture a meaningful failing case before the implementation, then green evidence and relevant refactor checks. Tooling/prose-only work uses appropriate negative checks without artificial application tests. Live/runtime profiles require reviewed commits, a dedicated trusted test environment and explicit authorization for the concrete experiment. Public PR CI uses hosted environments without credentials. Planned or skipped tests never count as passed.

Acceptance criteria

• Linux and macOS canary evidence and pool resource settings are recorded.
• Legacy identities are never imported solely by name prefix.
• Workflow routing labels remain stable when scaling worker count.
• Record rollout verdict and rollback path; current planning task does not perform migration.
• Record exact validation commands, actual results, skipped/live-test gaps and applicable rollback notes in the PR.
• Independent review is resolved and the focused PR is merged under the repository execution policy.
• Update issue/Project accurately; mark the active goal complete only after all required evidence and work are complete.

Safety invariants

Preserve existing manual runners; no global Docker prune/context switching, broad process kill, implicit App enrollment, busy-job cancellation during ordinary scale-down or transparent workflow replay. Use only verifiably owned resources. Keep management credentials and raw secret-bearing SDK errors out of worker environments, logs, fixtures and commits; per-worker JIT transport follows G01. Native pools remain trusted-only.

Design references

• Architecture and gates
• Language decision
• Security design
• TDD strategy
• Goal/model execution policy
• Ordered backlog