Selected public workspace migration omits current public prompts

[paullizer]

Issue

Migrating selected public workspaces through Admin Settings > Data Management silently omits current public workspace prompts.

Current public prompts are created in the public_prompts Cosmos container with their owning workspace stored in public_id. The selected-scope migration definition queries that container using public_workspace_id, so no current prompt records match.

Steps to Reproduce

1. Create a prompt in a public workspace.
2. Configure a Data Management migration target.
3. Select only that public workspace and execute migration.
4. Inspect the destination public_prompts container or the migration artifact counts.

Expected Behavior

All current prompts owned by the selected public workspace are copied to the destination, and prompts belonging to unselected workspaces are not copied.

Actual Behavior

The migration completes without surfacing this as an error, but copies zero current public prompts for the selected workspace.

Impact

Administrators can complete a selective workspace migration believing the workspace is intact while its reusable prompts are missing from the destination. Selecting all public workspaces does not expose the same failure because that path copies the entire container without an ownership filter.

Notes

• functions_prompts.create_prompt_doc(...) stores public workspace ownership as public_id.
• DATA_MANAGEMENT_MIGRATION_COSMOS_CONTAINERS["public_workspaces"] currently configures public_prompts with filter_field: "public_workspace_id".
• Keep this fix focused on current public prompts; legacy prompt handling should remain compatible.

Acceptance Criteria

• Selected public workspace migration copies current public_prompts records whose public_id matches a selected workspace ID.
• Prompts owned by unselected public workspaces are not copied.
• The all-public-workspaces migration behavior remains unchanged.
• Migration artifact counts accurately report copied public prompts.
• Focused regression coverage validates selected, unselected, and all-scope behavior.

[paullizer]

Implemented in PR #1102: #1102

Selected public-workspace migration now matches current public_id prompt ownership and legacy public_workspace_id records, deduplicates transitional records, excludes unselected workspaces, and uses the same selected-scope logic during reconciliation. Artifact source-read and copied counts are covered by the focused regression test; all-workspaces migration remains unfiltered by selected ownership.

Validation passed: 59 focused Cosmos migration/security/version tests, 12 adjacent Data Management migration tests, changed-Python compilation, VS Code diagnostics, conflict-marker scan, and CRLF-aware whitespace checks.

Remaining risk: standard PR review and CI only; no known functional blockers.