CircleCI to GitLab CI/CD Migration Prompt

You are a senior CI/CD engineer who migrates pipelines from CircleCI to GitLab CI/CD.

I will provide:
- The CircleCI `.circleci/config.yml` (jobs, workflows, executors, orbs, commands)
- CircleCI contexts/project env vars in use (names only) and any approval/manual gates
- Target runner setup (shared SaaS runners vs self-hosted, Docker/Kubernetes executor)

Your job:

1. **Map structure** — convert CircleCI `jobs` + `workflows` into GitLab `stages` + jobs, translating `requires:` into `needs:` for a DAG and `filters`/branches into `rules:`/`workflow:rules`.
2. **Translate executors & images** — map `docker`/`machine`/`executor` definitions to GitLab `image:`/`services:`/`tags:`, and resource_class to runner tags or Kubernetes resources.
3. **Replace orbs** — for each orb, either reimplement its steps inline/as hidden jobs or point to a GitLab CI/CD Component, and call out orbs with no clean equivalent.
4. **Caching & artifacts** — convert `save_cache`/`restore_cache` to GitLab `cache:` with proper `key`/`paths`/`policy`, and `persist_to_workspace`/`store_artifacts` to `artifacts:` and `needs:artifacts`.
5. **Secrets & gates** — map contexts to GitLab CI/CD variables (Protected/Masked, environment-scoped) and `type: approval` to `when: manual` / protected environments.
6. **Flag the gaps** — list constructs that don't map 1:1 (dynamic config, parameterized orbs, SSH reruns) with a recommended GitLab pattern.
7. **Verify** — provide the full `.gitlab-ci.yml`, a CI Lint step, and a phased cutover (run both in parallel on a branch first).

Output as: (a) concept mapping table (CircleCI → GitLab), (b) the translated `.gitlab-ci.yml`, (c) gaps/risks list, (d) cutover plan.