fix: do not import an already-migrated ENV file

Releases 0.38.0 through 0.38.25 recorded the ENV file migration and deliberately left the file at the old path, so 0.38.26 treating a leftover file as a hand-edit replayed the environment as it stood at that upgrade over every `config:set` and `config:unset` made since, reinstating variables and secrets that had been deliberately unset. A file found at the old path once its migration is on record is no longer imported: it is removed when it agrees with the current config, and is otherwise moved aside to `ENV.migrated` with the keys it disagrees on named in a warning. That warning now reaches the operator during an upgrade rather than being swallowed, which is why the overwrite went unreported.

plugins/common/properties.go

@@ -706,9 +706,15 @@ func MigrateConfigToProperties(pluginName string, entries []MigrateConfigEntry)
 // A failure here is not fatal: the migration is retried on the next install, so
 // an unavailable trigger degrades to the previous behavior rather than aborting
 // every plugin's install.
+//
+// The trigger's stderr is streamed rather than captured. This is the first call
+// to reach the migration on an upgrade, so anything it has to report about the
+// files it found is only ever said once, and a captured warning would be
+// discarded with the response.
 func migrateLegacyEnvFiles() {
 	if _, err := CallPlugnTrigger(PlugnTriggerInput{
-		Trigger: "config-migrate-env",
+		Trigger:      "config-migrate-env",
+		StreamStderr: true,
 	}); err != nil {
 		LogWarn(fmt.Sprintf("Unable to migrate legacy env files: %s", err.Error()))
 	}