Any safe suggestions?
"Checklist procedures" are NOT safe.
An axiom of electrical design is that we don't rely on "checklist procedures" to assure electrical safety. Your setup requires a fairly convoluted procedure to disconnect the panels from the grid and get generator power into (at least one of) them.
The US Marines have a saying. There's a myth that in a crisis, people will find some hidden clarity-of-mind and wisdom. Untrue: "People don't rise to a crisis - they fall back to the level of their training". And that's why the US Marines and friends train so darn hard. If you've followed the news in the last month, you see this (or its lack) on full display.
So NEC is very clear that you need to have mechanical interlocks to physically prevent dangerous configurations from being set.
If you think about it earnestly, they're right. You could mess up in the stress of it. What if you're not there and a family member asks a neighbor? They're not going to get it right. They're going to throw switches madly, trying everything. And they're going to stop at the first combination that seems to work.
By the way, power companies are draconian toward people caught back-feeding and can cause rather serious knock-on effects for those caught. Which smart meters make easier.
What these panels are
What you have here is 400A service, also called "Class 320" (the power company sees it as a 320A "continuous load"). 400A breakers are prohibitively expensive today, and were even moreso when this installation was done. So the bog-standard way of installing 400A service is to have a "Meter Pan" outside with and dual 250 kcmil lugs at the bottom. From those lugs, 250 kcmil (sometimes 4/0) wire is run to each of two main panels. Each main panel has a 200A breaker.
That's what you're looking at. There is no split "in the walls" (junctions are never buried, all boxes must remain accessible forever)... these service entrance cables go straight into the meter pan. Those cables are totally un-fused, and as much as 22,000 amps can flow if you drove a nail through one of them. As such, those cables are required to be as short as possible, and guarded as much as possible.
NEC 2020 now requires (indirectly) that the main breakers be part of the meter pan, so those lines now have circuit breaker protection.
Powering 2 panels from 1 generator: Move circuits.
Generally speaking, it's not possible, because of neutral problems. The only ways to do it are to have a transfer switch which switches neutral, or have a transformer that provides isolation.
Or the other way is to have a "master" transfer switch upstream of both panels. For instance coming direct off the meter to a 400A transfer switch, and then feed each panel from the transfer switch.
So, in 400A installations like yours, the path of least, um, resistance is almost always to simply designate ONE of the panels to be the "critical loads panel", and feed that panel only from the generator.
Now how do you move a circuit between panels? The obvious method is to re-route the Romex cable to enter the other panel. However, most smart installers mounting two panels will install a few conduit pipes between the two panels. Or some flex conduit could be installed between the bottoms of the panels. A circuit entering one panel can be "brought over to the other panel" by extending all wires except ground, including neutral, to the other panel via the conduit. Use wire nuts to extend those wires. THHN individual wires (sold by the foot at better stores) are usually used for this. Land the extended hot(s) on their new breaker and the extended neutral on the neutral bar. Rerouting the neutral seems silly but it's essential to avoid weird problems, NEC 300.3.
Physical interlock(s) at the panel
The Code legal way of doing what you're doing, trying to switch a whole panel, is a simple and inexpensive "sliding plate interlock". Most of the cost is in the engineering and certification, really. The sliding plate assures that your main breaker and your "backfeed generator breaker" cannot be on at the same time. Simple as that.
It requires the generator breaker, which is back-fed, to be placed at top left or top right, as the interlock physically requires.
On having the shop feeder double as a generator feeder
Yeah, nope, you can't do that. The reason is, it becomes impossible to make the interlocks work. (what? Very long Bowden cable? LOL)
The only correct advice is to run two separate feeders. Whenever people ask this before they do the installation, we tell them to do exactly that, and steer them into aluminum feeder, which is proven reliable for heavy feeders, and is a net savings actually.
Now let's talk about options from where you are.
If you ran conduit, we need to have a conversation about conduit size and how we can get 2 feeders in there (it's perfectly allowed).
Another option is to re-configure it so that the one feeder is the generator supply only and is wired to an interlocked breaker. This would mean you would need to run the generator to power anything in the shop.
Another option is what I call "permanent wiring, temporarily". You are free to wire something to be a particular way permanently... and then 3 days later wire it to be another way permanently. In the subpanel, you bring in the generator leads and cap them off. At the main panel, you permanently install interlock and generator breaker with nothing connected to it. When the power fails, you shut everything off, and "permanently" rewire the FORMER subpanel feeder to be ONLY a generator feeder, by moving wires at both ends. When power comes back on, you "permanently" disconnect it as a generator feed and restore it as a subpanel feed.
