Add project mapping and safer dry-run output

[Curtis Galione (cjgalione)]

Summary

• Add explicit source-project to destination-project name mapping via --project-map, --project-map-file, MIGRATION_PROJECT_MAP, and MIGRATION_PROJECT_MAP_FILE
• Preserve same-name destination lookup/create behavior when no mapping is provided
• Improve migrate --dry-run to show selected resources, created-time filters, project mapping status, and a read-only logs BTQL limit: 1 probe

Notes

• --projects continues to select source project names.
• Project mapping is exact and one-way: source project name -> destination project name.
• This does not add trace-ID filtering or source deletion.
• Dry-run remains read-only and reports destination projects as exists or would create.

Testing

• uv run pytest tests/unit/test_config.py tests/unit/test_cli_dry_run.py tests/unit/test_orchestrator_migrate_all.py
• uv run pytest
• uv run ruff check braintrust_migrate/config.py braintrust_migrate/cli.py braintrust_migrate/orchestration.py tests/unit/test_config.py tests/unit/test_cli_dry_run.py tests/unit/test_orchestrator_migrate_all.py

Known Repo-Wide Check Status

• uv run ruff check . currently fails on existing repo-wide lint issues outside the changed-file pass.
• uv run mypy braintrust_migrate currently fails on existing repo-wide strict typing issues.

[Curtis Galione (cjgalione)]

Ready for backend review.

Pre-review gates applied from braintrust-backend-pr-pre-review fetched at ef84d1a35e483bd1777a2628912bab382f628023.

• Ownership/scope: The change is scoped to braintrust-migrate config, CLI dry-run planning, orchestration, docs, and focused unit tests. No Braintrust service endpoint, route harness, schema, auth, RBAC, or data-plane API surface is changed.
• API/contract shape: --projects remains source-project selection; project_name_mapping is exact source name to destination name with same-name fallback. Inline/file inputs are mutually exclusive and validated as non-empty string-to-string JSON objects.
• Auth/API-key handling: No new credentials, token propagation, or permission shortcuts. The destination API key still governs whether lookup/create/write operations are allowed.
• Ingestion/object-copy behavior: Real migration keeps the existing source project ID to destination project ID mapping model; only destination project name lookup/create changes. Dry-run never calls create_project.
• Dry-run behavior: The plan table shows resources, source projects, created time window, source/destination project names, IDs, and destination status. The logs probe is read-only, uses source project IDs plus created filters, and caps itself to limit: 1.
• Tests: Added coverage for project-map parsing, env/file mutual exclusion, mapped same-name/different-name orchestration, report output, dry-run destination statuses, and logs probe query shape/no inserts.

Verification:

• uv run pytest tests/unit/test_config.py tests/unit/test_cli_dry_run.py tests/unit/test_orchestrator_migrate_all.py
• uv run pytest
• uv run ruff check braintrust_migrate/config.py braintrust_migrate/cli.py braintrust_migrate/orchestration.py tests/unit/test_config.py tests/unit/test_cli_dry_run.py tests/unit/test_orchestrator_migrate_all.py
• uv run braintrust-migrate migrate --help
• git diff --check

Known narrow risks:

• The logs dry-run probe runs one read-only limit: 1 BTQL query per selected source project when logs is selected, including via resources=all; this is intentionally lightweight but still serial.
• Repo-wide uv run ruff check . and uv run mypy braintrust_migrate still fail on pre-existing unrelated issues outside this diff; changed-file Ruff and the full test suite pass.