The pilot-to-production gap you describe is mostly a scoping problem. A pilot proves the platform works on a friendly workload. Production is twenty workloads that each carry their own secrets, stateful dependencies, noisy neighbours, and someone who remembers why a cron job runs at 3 a.m.
What has worked for us is treating each wave of the migration as its own bounded problem with exit criteria: workloads named, data moved and verified, rollback rehearsed, alerts proven, and the old path switched off. If a wave cannot state those, it is not ready to start.
That also keeps leadership honest about progress. "The cluster is up" is a pilot metric. "These services are off the old hosts and nobody was paged" is the production one.