feat(mtmharness): add Cloudflare skills

packages/mtmharness/README.md

@@ -2,13 +2,15 @@
 
 `mtmharness` is one public npm package with one unified DSH plugin and two explicit client identities:
 
-- **DSH Web plugin**: the package root and `./client` export use the official `dsh.client` lazy-CJS contract. One installation provides the settings-controlled MTM Connect secondary extension and the Codebase Memory/Modern Go/Ponytail/RTK coding features.
+- **DSH Web plugin**: the package root and `./client` export use the official `dsh.client` lazy-CJS contract. One installation provides the settings-controlled MTM Connect secondary extension and the Codebase Memory/Modern Go/Ponytail/RTK/Cloudflare coding features.
 - **Independent web client**: the package also publishes a BrowserHistory static app and a MemoryHistory script/embed entry. These artifacts own their React root, router, styles, and teardown and never load the local coding runtime.
 
 The DSH plugin is assembled from coding and secondary frontend domains under one Host/Client lifecycle. Codebase Memory keeps its `codebase_memory` server namespace and `mcp__codebase_memory__*` tool names; Ponytail exposes six externally installed skills through DSH's native skill surface. The `/ponytail` command controls per-agent automatic prompt intensity; `off` suppresses that section while explicit native skill invocation remains available. The five companion names are not duplicated as host commands. The `mtm-coding` settings namespace contains the runtime extension toggles.
 
 Modern Go Guidelines is a configured data-only package that exposes the externally installed `use-modern-go` skill. No manual Go or CLI installation is required; the upstream wrapper installs the pinned CLI on first use with standard `go install` and user cache behavior. Its trusted manifest pins the JetBrains `v0.1.1` source and SHA-256; the first load downloads it into `$DSH_HOME/mtmharness/skills/modern-go`. Existing files are user-owned and are never overwritten automatically. The wrapper does not modify the project or create a project-local `.mtmharness-cache`. If the active DSH file policy denies the standard Go cache write, the command reports that error instead of overriding the sandbox.
 
+Cloudflare is a configured data-only package exposing the 13 upstream Cloudflare Agent Skills. Its manifest pins the source commit and SHA-256 for the full skill resources, including relative references, and installs them into `$DSH_HOME/mtmharness/skills/cloudflare` on first use. The package does not enable the upstream Cloudflare MCP server or client-specific commands; those require separate authentication and host integration.
+
 RTK is an optional coding feature in the same `mtm-coding` settings namespace. `rtkMode` defaults to `auto` and provides guidance for explicitly invoking an RTK command when the executable is available. The current DSH ToolRuntime has no supported pre-dispatch input-rewrite seam, so the plugin does not register a speculative hook; `rewrite` reports `unavailable` and leaves frozen tool arguments unchanged. The pinned RTK `v0.45.0` runtime helpers remain checksum-verified for explicit integrations; there is no separate RTK skill document. RTK telemetry, tracking, and tee output are disabled for plugin-managed runs.
 
 ## Coding Skill Files