Initial commit: VaultMesh Skills collection

Collection of operational skills for VaultMesh infrastructure including:
- backup-sovereign: Backup and recovery operations
- btc-anchor: Bitcoin anchoring
- cloudflare-tunnel-manager: Cloudflare tunnel management
- container-registry: Container registry operations
- disaster-recovery: Disaster recovery procedures
- dns-sovereign: DNS management
- eth-anchor: Ethereum anchoring
- gitea-bootstrap: Gitea setup and configuration
- hetzner-bootstrap: Hetzner server provisioning
- merkle-forest: Merkle tree operations
- node-hardening: Node security hardening
- operator-bootstrap: Operator initialization
- proof-verifier: Cryptographic proof verification
- rfc3161-anchor: RFC3161 timestamping
- secrets-vault: Secrets management

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

cloudflare-tunnel-manager/scripts/11_tunnel_apply.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+SKILL_ROOT="$(dirname "$SCRIPT_DIR")"
+source "$SCRIPT_DIR/_common.sh"
+
+: "${CF_API_TOKEN:=}"
+: "${CF_ACCOUNT_ID:=}"
+: "${TUNNEL_NAME:=}"
+: "${CONFIG_DIR:=$SKILL_ROOT/outputs/config}"
+
+main() {
+  confirm_gate
+  cf_env_check
+  [[ -n "$TUNNEL_NAME" ]] || die "TUNNEL_NAME is required."
+  mkdir -p "$CONFIG_DIR"
+
+  # List tunnels and locate by name
+  log_info "Looking for existing tunnel: $TUNNEL_NAME"
+  local list_json
+  list_json="$(cloudflared tunnel --origincert /dev/null list --output json 2>/dev/null || true)"
+
+  # If list command fails (often needs login), fall back to API call
+  local tunnel_id=""
+  if [[ -n "$list_json" ]]; then
+    tunnel_id="$(echo "$list_json" | jq -r --arg n "$TUNNEL_NAME" '.[] | select(.name==$n) | .id' | head -n 1 || true)"
+  fi
+
+  if [[ -z "$tunnel_id" || "$tunnel_id" == "null" ]]; then
+    log_warn "Tunnel not found via CLI list (or CLI not logged in). Creating tunnel via cloudflared..."
+    # cloudflared tunnel create requires local credentials; this will prompt if needed.
+    cloudflared tunnel create "$TUNNEL_NAME"
+    # After creation, attempt list again
+    list_json="$(cloudflared tunnel list --output json 2>/dev/null || true)"
+    tunnel_id="$(echo "$list_json" | jq -r --arg n "$TUNNEL_NAME" '.[] | select(.name==$n) | .id' | head -n 1 || true)"
+  fi
+
+  [[ -n "$tunnel_id" && "$tunnel_id" != "null" ]] || die "Unable to determine tunnel id for $TUNNEL_NAME. Ensure cloudflared is authenticated."
+
+  log_info "Tunnel id: $tunnel_id"
+
+  # Snapshot tunnel info
+  cat > "$CONFIG_DIR/tunnel.json" <<EOF
+{
+  "name": "$(json_escape "$TUNNEL_NAME")",
+  "id": "$(json_escape "$tunnel_id")",
+  "generated": "$(date -Iseconds)"
+}
+EOF
+
+  log_info "Wrote tunnel snapshot: $CONFIG_DIR/tunnel.json"
+  log_info "Next: ./scripts/20_dns_plan.sh"
+}
+
+main "$@"