Initial commit: VaultMesh Skills collection

Collection of operational skills for VaultMesh infrastructure including:
- backup-sovereign: Backup and recovery operations
- btc-anchor: Bitcoin anchoring
- cloudflare-tunnel-manager: Cloudflare tunnel management
- container-registry: Container registry operations
- disaster-recovery: Disaster recovery procedures
- dns-sovereign: DNS management
- eth-anchor: Ethereum anchoring
- gitea-bootstrap: Gitea setup and configuration
- hetzner-bootstrap: Hetzner server provisioning
- merkle-forest: Merkle tree operations
- node-hardening: Node security hardening
- operator-bootstrap: Operator initialization
- proof-verifier: Cryptographic proof verification
- rfc3161-anchor: RFC3161 timestamping
- secrets-vault: Secrets management

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

container-registry/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: container-registry
+description: >
+  Bootstrap a sovereign container registry (OCI/Docker) with plan/apply/rollback,
+  signature verification hooks, backups, and audit report. Designed to pair with
+  gitea-bootstrap on Node B. Triggers: 'container registry', 'docker registry',
+  'oci registry', 'self-host registry', 'registry plan'.
+version: 1.0.0
+---
+
+# Container Registry (Sovereign)
+
+Tier 2 skill: establish a **self-hosted OCI registry** you control.
+
+This skill deploys a Docker Registry v2 (with optional UI) using
+plan/apply gates and produces verifiable artifacts.
+
+## Quick Start
+
+```bash
+cd ~/.claude/skills/container-registry
+
+export MODE="docker"                 # docker only in v1
+export NODE_NAME="node-b"
+
+# Network
+export REGISTRY_PORT=5000
+export DOMAIN="registry.example.com"   # optional (for reverse proxy)
+
+# Storage
+export DATA_DIR="$HOME/registry"
+export AUTH_DIR="$HOME/registry/auth"
+
+# Auth (basic auth for v1)
+export REGISTRY_USER="sovereign"
+
+# Safety
+export DRY_RUN=1
+export REQUIRE_CONFIRM=1
+export CONFIRM_PHRASE="I UNDERSTAND THIS WILL DEPLOY A CONTAINER REGISTRY"
+
+./scripts/00_preflight.sh
+./scripts/10_plan.sh
+
+export DRY_RUN=0
+./scripts/11_apply.sh
+
+./scripts/90_verify.sh
+./scripts/99_report.sh
+```
+
+## Inputs
+
+| Parameter | Required | Default | Description |
+|---|---:|---|---|
+| MODE | Yes | docker | docker |
+| REGISTRY_PORT | No | 5000 | Registry port |
+| DOMAIN | No | (empty) | Hostname if proxied |
+| DATA_DIR | No | ~/registry | Registry storage |
+| AUTH_DIR | No | ~/registry/auth | htpasswd storage |
+| REGISTRY_USER | Yes | (none) | Registry username |
+| DRY_RUN | No | 1 | Apply refuses unless DRY_RUN=0 |
+| REQUIRE_CONFIRM | No | 1 | Require confirmation phrase |
+| CONFIRM_PHRASE | No | I UNDERSTAND THIS WILL DEPLOY A CONTAINER REGISTRY | Safety phrase |
+
+## Outputs
+
+- `outputs/compose.yml`
+- `outputs/htpasswd`
+- `outputs/status_matrix.json`
+- `outputs/audit_report.md`
+- Backups under `outputs/backups/`
+
+## Security Notes (v1)
+
+- Basic auth (htpasswd)
+- TLS termination expected via reverse proxy or Cloudflare Tunnel
+- Image signing handled upstream (cosign/notation integration planned)
+
+## EU Compliance
+
+| Aspect | Value |
+|---|---|
+| Data Residency | EU (Ireland - Dublin) |
+| Jurisdiction | Irish Law |
+| Images | Stored on Node B |
+| Access | Authenticated |
+
+## References
+- [OCI Registry Notes](references/registry_notes.md)