Initial commit: VaultMesh Skills collection

Collection of operational skills for VaultMesh infrastructure including:
- backup-sovereign: Backup and recovery operations
- btc-anchor: Bitcoin anchoring
- cloudflare-tunnel-manager: Cloudflare tunnel management
- container-registry: Container registry operations
- disaster-recovery: Disaster recovery procedures
- dns-sovereign: DNS management
- eth-anchor: Ethereum anchoring
- gitea-bootstrap: Gitea setup and configuration
- hetzner-bootstrap: Hetzner server provisioning
- merkle-forest: Merkle tree operations
- node-hardening: Node security hardening
- operator-bootstrap: Operator initialization
- proof-verifier: Cryptographic proof verification
- rfc3161-anchor: RFC3161 timestamping
- secrets-vault: Secrets management

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

eth-anchor/scripts/11_apply.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+set -euo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+SKILL_ROOT="$(dirname "$SCRIPT_DIR")"
+source "$SCRIPT_DIR/_common.sh"
+
+: "${ETH_RPC_URL:=}"
+: "${CHAIN_ID:=1}"
+: "${TO_ADDRESS:=0x0000000000000000000000000000000000000000}"
+: "${GAS_LIMIT:=60000}"
+: "${VALUE_WEI:=0}"
+: "${ETH_PRIVATE_KEY:=}"
+: "${LABEL:=eth-anchor}"
+
+main() {
+  confirm_gate
+  [[ -n "$ETH_RPC_URL" ]] || die "ETH_RPC_URL required."
+  [[ -n "$ETH_PRIVATE_KEY" ]] || die "ETH_PRIVATE_KEY required."
+
+  mkdir -p "$SKILL_ROOT/outputs/runs"
+  ts="$(date -Iseconds | tr ':' '-')"
+  run_dir="$SKILL_ROOT/outputs/runs/${LABEL}_${ts}"
+  mkdir -p "$run_dir"
+
+  root_hex="$(read_root_hex)"
+  payload="$(pad_to_32_bytes_hex "$root_hex")"
+  echo "$root_hex" > "$run_dir/root_hex.txt"
+
+  # send tx
+  log_info "Sending calldata tx..."
+  tx_hash="$(cast send --rpc-url "$ETH_RPC_URL" --private-key "$ETH_PRIVATE_KEY" \
+    --gas-limit "$GAS_LIMIT" --value "$VALUE_WEI" \
+    "$TO_ADDRESS" "0x$payload" | awk '/transactionHash/ {print $2}' | tr -d '\r' || true)"
+
+  # cast output format varies; fallback: take last 0x... in output
+  if [[ -z "$tx_hash" ]]; then
+    tx_hash="$(cast send --rpc-url "$ETH_RPC_URL" --private-key "$ETH_PRIVATE_KEY" \
+      --gas-limit "$GAS_LIMIT" --value "$VALUE_WEI" \
+      "$TO_ADDRESS" "0x$payload" 2>/dev/null | grep -Eo '0x[a-fA-F0-9]{64}' | tail -n1 || true)"
+  fi
+  [[ -n "$tx_hash" ]] || die "Unable to parse tx hash from cast output."
+
+  echo "$tx_hash" > "$run_dir/tx_hash.txt"
+
+  log_info "Fetching receipt..."
+  cast receipt --rpc-url "$ETH_RPC_URL" "$tx_hash" --json > "$run_dir/tx_receipt.json" || true
+
+  cat > "$run_dir/PROOF.json" <<EOF
+{
+  "skill": "eth-anchor",
+  "version": "1.0.0",
+  "timestamp": "$(date -Iseconds)",
+  "chain_id": "$(cast chain-id --rpc-url "$ETH_RPC_URL")",
+  "to": "$TO_ADDRESS",
+  "value_wei": "$VALUE_WEI",
+  "gas_limit": "$GAS_LIMIT",
+  "root_hex": "$(json_escape "$root_hex")",
+  "calldata": "0x$payload",
+  "tx_hash": "$(json_escape "$tx_hash")",
+  "artifacts": {
+    "root_hex_file": "root_hex.txt",
+    "tx_hash_file": "tx_hash.txt",
+    "tx_receipt": "tx_receipt.json"
+  }
+}
+EOF
+
+  echo "$run_dir" > "$SKILL_ROOT/outputs/last_run_dir.txt"
+  log_info "Anchored on ETH. tx=$tx_hash"
+  log_info "Run dir: $run_dir"
+}
+main "$@"