Please address the comments from this code review:

## Overall Comments
- The `source` interface comment says `CentralDBDeployment` may return nil when not found, but both `dirSource` and `clusterSource` implementations return a non-nil error instead; consider updating the comment or behavior so they are consistent.
- The `splitYAMLDocuments` helper relies on a simple `strings.Split` on `"\n---"`, which may break in edge cases (e.g., documents starting with `---`, Windows line endings, or `---` in content); consider using `yaml.Decoder` to iterate documents more robustly.

## Individual Comments

### Comment 1
<location path="roxctl/central/migratetooperator/source.go" line_range="10" />
<code_context>
+// source provides access to Kubernetes resources from either a directory
+// of YAML manifests or a live cluster.
+type source interface {
+	// CentralDBDeployment returns the central-db Deployment, or nil if not found.
+	CentralDBDeployment() (*appsv1.Deployment, error)
+}
</code_context>
<issue_to_address>
**issue (bug_risk):** Align the `CentralDBDeployment` contract with the implementations that never return nil without an error

The interface comment implies `CentralDBDeployment` may return `nil` without an error, but current implementations always return either a deployment or a non-nil error, and callers (e.g. `detectStorage`) assume a non-nil deployment on success. Please either update the comment to state that "not found" is returned as an error, or update implementations and callers to correctly support a `nil`-without-error result.
</issue_to_address>

### Comment 2
<location path="roxctl/central/migratetooperator/dir_source_test.go" line_range="12-21" />
<code_context>
+	"github.com/stretchr/testify/require"
+)
+
+func TestDirSource_PVC(t *testing.T) {
+	dir := t.TempDir()
+	centralDir := filepath.Join(dir, "central")
+	require.NoError(t, os.MkdirAll(centralDir, 0755))
+
+	deploymentYAML := `apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: central-db
+spec:
+  template:
+    spec:
+      volumes:
+      - name: disk
+        persistentVolumeClaim:
+          claimName: my-pvc
+`
+	require.NoError(t, os.WriteFile(filepath.Join(centralDir, "01-central-12-central-db.yaml"), []byte(deploymentYAML), 0644))
+
+	src, err := newDirSource(dir)
+	require.NoError(t, err)
+
+	dep, err := src.CentralDBDeployment()
+	require.NoError(t, err)
+	assert.Equal(t, "central-db", dep.Name)
+
+	require.Len(t, dep.Spec.Template.Spec.Volumes, 1)
+	require.NotNil(t, dep.Spec.Template.Spec.Volumes[0].PersistentVolumeClaim)
+	assert.Equal(t, "my-pvc", dep.Spec.Template.Spec.Volumes[0].PersistentVolumeClaim.ClaimName)
+}
+
</code_context>
<issue_to_address>
**suggestion (testing):** Add tests for `newDirSource` error cases (nonexistent path and non-directory path)

The existing tests only cover the happy path for `dirSource`. Please also add tests that assert `newDirSource` fails as expected when the path does not exist/unreadable and when it points to a non-directory, including checking the returned error messages (e.g., "accessing directory" vs. "is not a directory").

Suggested implementation:

```golang
import (
	"os"
	"path/filepath"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func TestDirSource_PVC(t *testing.T) {
	dir := t.TempDir()
	centralDir := filepath.Join(dir, "central")
	require.NoError(t, os.MkdirAll(centralDir, 0o755))

	deploymentYAML := `apiVersion: apps/v1
kind: Deployment
metadata:
  name: central-db
spec:
  template:
    spec:
      volumes:
      - name: disk
        persistentVolumeClaim:
          claimName: my-pvc
`
	require.NoError(t, os.WriteFile(filepath.Join(centralDir, "01-central-12-central-db.yaml"), []byte(deploymentYAML), 0o644))

	src, err := newDirSource(dir)
	require.NoError(t, err)

	dep, err := src.CentralDBDeployment()
	require.NoError(t, err)
	assert.Equal(t, "central-db", dep.Name)

	require.Len(t, dep.Spec.Template.Spec.Volumes, 1)
	require.NotNil(t, dep.Spec.Template.Spec.Volumes[0].PersistentVolumeClaim)
	assert.Equal(t, "my-pvc", dep.Spec.Template.Spec.Volumes[0].PersistentVolumeClaim.ClaimName)
}

func TestNewDirSource_NonexistentPath(t *testing.T) {
	// Use a subpath of TempDir that we do not create, ensuring it does not exist.
	base := t.TempDir()
	nonexistentPath := filepath.Join(base, "does-not-exist")

	src, err := newDirSource(nonexistentPath)
	require.Error(t, err)
	assert.Nil(t, src)
	// newDirSource should surface that it failed while accessing the directory.
	require.ErrorContains(t, err, "accessing directory")
}

func TestNewDirSource_NonDirectoryPath(t *testing.T) {
	dir := t.TempDir()
	filePath := filepath.Join(dir, "not-a-directory")

	require.NoError(t, os.WriteFile(filePath, []byte("not a directory"), 0o644))

	src, err := newDirSource(filePath)
	require.Error(t, err)
	assert.Nil(t, src)
	// newDirSource should clearly indicate that the path is not a directory.
	require.ErrorContains(t, err, "is not a directory")
}

```

These changes assume that:
1. `newDirSource` returns a `nil` source on error and wraps filesystem errors with messages containing "accessing directory" when the path doesn't exist/unreadable, and "is not a directory" when the path is a non-directory.
2. No other tests in this file depend on the duplicated import block that was consolidated.

If the actual error messages differ slightly, update the `require.ErrorContains` substrings to match the real messages used in `newDirSource`.
</issue_to_address>