Initial commit: VaultMesh Skills collection

Collection of operational skills for VaultMesh infrastructure including:
- backup-sovereign: Backup and recovery operations
- btc-anchor: Bitcoin anchoring
- cloudflare-tunnel-manager: Cloudflare tunnel management
- container-registry: Container registry operations
- disaster-recovery: Disaster recovery procedures
- dns-sovereign: DNS management
- eth-anchor: Ethereum anchoring
- gitea-bootstrap: Gitea setup and configuration
- hetzner-bootstrap: Hetzner server provisioning
- merkle-forest: Merkle tree operations
- node-hardening: Node security hardening
- operator-bootstrap: Operator initialization
- proof-verifier: Cryptographic proof verification
- rfc3161-anchor: RFC3161 timestamping
- secrets-vault: Secrets management

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

eth-anchor/SKILL.md

@@ -0,0 +1,85 @@
+---
+name: eth-anchor
+description: >
+  Anchor a Merkle root (root_hex) to Ethereum using a minimal calldata transaction,
+  emit PROOF.json + tx metadata, with plan/apply/rollback and verification.
+  Consumes merkle-forest ROOT.txt (or explicit ROOT_HEX). Triggers: 'eth anchor',
+  'anchor root on ethereum', 'calldata tx', 'proof on chain'.
+version: 1.0.0
+---
+
+# ETH Anchor (Calldata TX)
+
+This skill anchors a **root_hex** to Ethereum by sending a small transaction
+with the root embedded in **data** (calldata). It outputs a proof receipt
+linking **ROOT.txt → tx hash → chain**.
+
+## Requirements
+- `cast` (Foundry) **or** `ethers`-compatible RPC with `curl` is possible; v1 uses `cast`.
+- RPC URL for the target network.
+- A funded private key (hot key) OR hardware wallet workflow (not implemented in v1).
+
+## Quick Start
+
+```bash
+cd ~/.claude/skills/eth-anchor
+
+# inputs
+export ROOT_FILE="$HOME/.claude/skills/merkle-forest/outputs/runs/<run>/ROOT.txt"
+# or: export ROOT_HEX="..."
+
+# chain
+export ETH_RPC_URL="https://..."
+export CHAIN_ID=1                     # 1 mainnet, 11155111 sepolia, etc
+export TO_ADDRESS="0x0000000000000000000000000000000000000000"  # burn/null is fine for data-only tx
+
+# signer
+export ETH_PRIVATE_KEY="0x..."        # ensure funded
+
+# safety
+export DRY_RUN=1
+export REQUIRE_CONFIRM=1
+export CONFIRM_PHRASE="I UNDERSTAND THIS WILL SEND AN ETH TRANSACTION"
+
+./scripts/00_preflight.sh
+./scripts/10_plan.sh
+
+export DRY_RUN=0
+./scripts/11_apply.sh
+
+./scripts/90_verify.sh
+./scripts/99_report.sh
+```
+
+## Inputs
+
+| Parameter | Required | Default | Description |
+|---|---:|---|---|
+| ROOT_FILE | No | (empty) | Path to ROOT.txt from merkle-forest |
+| ROOT_HEX | No | (empty) | Explicit root hex (overrides ROOT_FILE) |
+| ETH_RPC_URL | Yes | (none) | RPC endpoint |
+| CHAIN_ID | No | 1 | Chain id |
+| TO_ADDRESS | No | 0x000…000 | Recipient (data-only tx) |
+| GAS_LIMIT | No | 60000 | Gas limit |
+| VALUE_WEI | No | 0 | Value to send (normally 0) |
+| ETH_PRIVATE_KEY | Yes | (none) | Hot key for signing (v1) |
+| DRY_RUN | No | 1 | Apply refuses unless DRY_RUN=0 |
+| REQUIRE_CONFIRM | No | 1 | Require confirmation phrase |
+| CONFIRM_PHRASE | No | I UNDERSTAND THIS WILL SEND AN ETH TRANSACTION | Safety phrase |
+
+## Outputs (per run)
+
+`outputs/runs/<label>_<timestamp>/`
+- `root_hex.txt`
+- `tx_hash.txt`
+- `tx_receipt.json`
+- `PROOF.json`
+- `status_matrix.json`
+- `audit_report.md`
+
+## Notes
+- Data payload: `0x` + `root_hex` (32 bytes / 64 hex). If root_hex is not 32 bytes, v1 right-pads to 32 bytes.
+- This is a simple anchor. If you later want "contract-based attestations", we can add an EAS backend.
+
+## EU Compliance
+EU (Ireland - Dublin), Irish jurisdiction. Anchors are public chain data.