test: cover the legacy -v migration with go and bats tests

Adds plugins/storage/migrate_test.go exercising migrateApp and MigrateLegacyMounts: single deploy phase, cross-phase grouping into one attachment, :ro and free-form volume options preserved on the attachment, idempotency on a second pass, the per-app flag-file fast path that skips already-migrated apps, and the name-collision refusal that aborts before draining. tests/unit/storage.bats gains an end-to-end case that stages a -v line via docker-options:add, runs storage:migrate, and asserts the synthesized colon form shows up in storage:list, the legacy-<hash> entry shows up in storage:list-entries, and the original -v line is gone from docker-options:report on both phases. To make that test (and operators with restored backups) practical, storage gains a storage:migrate <app>|--all subcommand backed by a new MigrateApp helper that skips the per-app flag file so a re-run actually re-scans.

plugins/storage/src/subcommands/subcommands.go

@@ -131,6 +131,11 @@ func main() {
 			AsUser: *asUser,
 			Args:   cmd,
 		})
+	case "migrate":
+		args := flag.NewFlagSet("storage:migrate", flag.ExitOnError)
+		all := args.Bool("all", false, "--all: re-migrate every app on this install")
+		args.Parse(os.Args[2:])
+		err = storage.CommandMigrate(args.Arg(0), *all)
 	case "wait":
 		args := flag.NewFlagSet("storage:wait", flag.ExitOnError)
 		args.Parse(os.Args[2:])