Initial commit: VaultMesh Skills collection

Collection of operational skills for VaultMesh infrastructure including:
- backup-sovereign: Backup and recovery operations
- btc-anchor: Bitcoin anchoring
- cloudflare-tunnel-manager: Cloudflare tunnel management
- container-registry: Container registry operations
- disaster-recovery: Disaster recovery procedures
- dns-sovereign: DNS management
- eth-anchor: Ethereum anchoring
- gitea-bootstrap: Gitea setup and configuration
- hetzner-bootstrap: Hetzner server provisioning
- merkle-forest: Merkle tree operations
- node-hardening: Node security hardening
- operator-bootstrap: Operator initialization
- proof-verifier: Cryptographic proof verification
- rfc3161-anchor: RFC3161 timestamping
- secrets-vault: Secrets management

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

btc-anchor/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: btc-anchor
+description: >
+  Anchor a Merkle root (root_hex) to Bitcoin testnet or mainnet using OP_RETURN via bitcoin-cli.
+  Emits PROOF.json + tx metadata with plan/apply/rollback and verification.
+  Consumes merkle-forest ROOT.txt (or explicit ROOT_HEX). Triggers: 'btc anchor',
+  'anchor root on bitcoin', 'op_return', 'taproot proof', 'bitcoin-cli'.
+version: 1.0.0
+---
+
+# BTC Anchor (OP_RETURN via bitcoin-cli)
+
+This skill anchors a **root_hex** on Bitcoin by creating a transaction
+with an **OP_RETURN** output containing the root bytes.
+
+## Requirements
+- `bitcoin-cli` connected to a synced node (mainnet/testnet/signet)
+- Wallet loaded + funded (UTXOs)
+- Network parameters set (v1 uses `bitcoin-cli -testnet` / `-signet` flags)
+
+## Quick Start
+
+```bash
+cd ~/.claude/skills/btc-anchor
+
+export ROOT_FILE="$HOME/.claude/skills/merkle-forest/outputs/runs/<run>/ROOT.txt"
+export BTC_NETWORK="testnet"          # mainnet|testnet|signet
+export BTC_FEE_RATE="5"              # sat/vB (rough)
+export OP_RETURN_PREFIX="VM"         # 2-byte ascii prefix
+
+./scripts/00_preflight.sh
+./scripts/10_plan.sh
+
+export DRY_RUN=0
+./scripts/11_apply.sh
+
+./scripts/90_verify.sh
+./scripts/99_report.sh
+```
+
+## Inputs
+
+| Parameter | Required | Default | Description |
+|---|---:|---|---|
+| ROOT_FILE | No | (empty) | ROOT.txt path |
+| ROOT_HEX | No | (empty) | Explicit root hex (overrides ROOT_FILE) |
+| BTC_NETWORK | No | testnet | mainnet/testnet/signet |
+| BTC_FEE_RATE | No | 5 | sat/vB (passed to walletcreatefundedpsbt) |
+| OP_RETURN_PREFIX | No | VM | ASCII prefix (helps identify payloads) |
+| DRY_RUN | No | 1 | Apply refuses unless DRY_RUN=0 |
+| REQUIRE_CONFIRM | No | 1 | Require confirmation phrase |
+| CONFIRM_PHRASE | No | I UNDERSTAND THIS WILL BROADCAST A BITCOIN TX | Safety phrase |
+
+## Outputs
+`outputs/runs/<label>_<timestamp>/`
+- root_hex.txt
+- op_return_hex.txt
+- txid.txt
+- rawtx.hex
+- PROOF.json
+- status_matrix.json
+- audit_report.md
+
+## Notes
+- Payload format: `<prefix-as-hex><root-bytes>` truncated to fit OP_RETURN.
+- v1 uses OP_RETURN and the node wallet RPCs: create raw tx → fund → sign → send.