feat: reacquire durable Cloudflare tunnel (#105)

## Summary
- persist the current tunnel credential in the existing SOPS-managed
Cloudflare Secret
- switch `ClusterTunnel/cluster-apps` from `newTunnel` to
`existingTunnel`
- reference the durable tunnel by both ID and name
- document the Terraform/Argo ownership boundary

## Ordering
Do not merge until the companion Terraform PR has merged and its
OpenTofu apply has imported the tunnel successfully. After sync, remove
the stale `newTunnel` finalizer and repair the current workload
ownership TXT records.

Companion: makeitworkcloud/tfroot-cloudflare#36

## Validation
- rendered the complete Cloudflare operator Kustomization with KSOPS
- verified the rendered credential document matches the existing tunnel
without displaying secret values
- all local pre-commit, YAML, secret-detection, and KubeLinter checks
passed

Author: xnoto

AGENTS.md

@@ -18,7 +18,7 @@ Read the closest nested `AGENTS.md` before changing a subtree. Preserve Kustomiz
 ## Cross-repository ownership
 
 - `charts/opencode-server` owns the packaged OpenCode server chart. Its post-publish workflow opens or updates a `kustomize-cluster` pull request that pins the `opencode` Application to the immutable published version. The generated PR must pass cluster CI and be reviewed and merged before GitOps reconciles it; the automation never syncs Argo CD or deploys directly.
-- `tfroot-cloudflare` owns bootstrap/non-tunnel Cloudflare infrastructure. Workload TunnelBinding resources own workload routes and DNS.
+- `tfroot-cloudflare` owns the durable cluster tunnel identity, bootstrap DNS, and non-tunnel Cloudflare infrastructure. `ClusterTunnel` references that tunnel with `existingTunnel`; workload `TunnelBinding` resources own local ingress routes and workload DNS.
 - `images` owns shared runner images; `shared-workflows` owns reusable Actions.
 
 ## Secrets and validation

operators/cloudflare/cloudflare-api-credentials-secret.yaml

@@ -6,18 +6,19 @@ metadata:
 type: Opaque
 stringData:
     CLOUDFLARE_API_TOKEN: ENC[AES256_GCM,data:zSq5DmP+DWrXHiza0Ki4/S1je6YZGA1oG6nSrlHmp56l6aSdsLEB/Q==,iv:7y5BzcFGxDSaaw0NJB5MxXAGWi3/sQZJcWtgc72JSnA=,tag:M7yHQ5YbsaL3STxKWKxNaQ==,type:str]
+    credentials.json: ENC[AES256_GCM,data:QXiz2QcEAeI4qibPZrRbzXKJ2PJzlhfpHFClzQK5EIUO3wgQvvUS9hTAphOdSrOoDOoUNiAQfB542b5sYMwgiLEqywHSFiW4i3qOdxSTH8cBheedm9/L2FhqqKeQKNgYtThKvFwcluFwUsWAvaO2Y2sqQ8LhIdu+rrS39yATJmvRaIRVNVajCAvhb0DDCnIk3Ok8EOrreNqEBp3HZ3I23/U=,iv:6dsGyW+/f25FDLrNKW6NOULuheIq9WM58E5mV1fpRpc=,tag:X1tI9hfpfUxxSYgbvt5/cA==,type:str]
 sops:
     age:
-        - recipient: age152ek83tm4fj5u70r3fecytn4kg7c5xca24erjchxexx4pfqg6das7q763l
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RFozVmRlWXQ5NG5MUVkx
             NjEvTWpzSFluRit5RXkxN3JvQTByK2xYdkZvCnlYVlgxUFhMVGVFZjBJOFFZQVJL
             R0N3TFJ3L3EwRTVjSUVHbjYwbkVIbWsKLS0tIE9nd2Q4c3Nsd1B6T3ZkaFp0Qzdx
             N1hnem5VTkw5TTZZUk9mNy81MTAybzQKW5r9MJJ6qxyS7mWNoD6PSL19Ncm6SZ9u
             m8KdBqQ2Krfsg/QiCn91tEZZvtdckGSOfxeYNZsBrDXRgNFyo4KWBQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-16T14:38:08Z"
-    mac: ENC[AES256_GCM,data:FQ3vjAMbIkMOlvIHr6flHE8ff3nbUXEQpdq1XPh7x6HYoY/F5OJ7c3Lns1UZRiecdut2AA9Bduld+fFxfw1W5d7uCjOQSdXF99XC/sV+iAtpzWiRsPQTnTUWYFSrUV8z/aul7TSxNGfQaZFawcygBXVjkTdnQHYq/jLeouGVJpU=,iv:8fWPPjFIed0UYOFPm7/ZYUpg0gj4QF03jHcOQdfteqM=,tag:z/Np14ikz/3phxBM+7COyA==,type:str]
+          recipient: age152ek83tm4fj5u70r3fecytn4kg7c5xca24erjchxexx4pfqg6das7q763l
     encrypted_regex: ^(token|api-token|apiToken|clientID|clientSecret|client_id|client_secret|password|secret|github_token|CLOUDFLARE_API_TOKEN|credentials\.json|.*_SERVICE_KEY|GF_AUTH_GITHUB_CLIENT_SECRET|GF_SECURITY_ADMIN_PASSWORD|dex\.github\.clientID|dex\.github\.clientSecret)$
+    lastmodified: "2026-08-28T20:48:00Z"
+    mac: ENC[AES256_GCM,data:bf1fba9aDgnnh8VXqg3+FIHg7rncRp6HTsQ5eWGvd0JRgb4zbqWceH6LlueQuD6EhXnxui4J1qmTctcVmo0AzP8WgfYQBHK+uxHHIpcWPfv6wiDSfKsKR2A8ECW5NhW0cIExbNoMRtQ+dp1VWXoT0fa7TQTE3ZxO8VOljwOMXD0=,iv:+jYV5UQJGwmmimDzSNywGQMf+P+kHUmLsA7T8Z7kt3o=,tag:cUWrmUNaSPF3sECINQO7Sg==,type:str]
     version: 3.12.1

operators/cloudflare/cluster-tunnel.yaml

@@ -6,13 +6,15 @@ metadata:
   annotations:
     argocd.argoproj.io/sync-wave: "0"
 spec:
-  newTunnel:
+  existingTunnel:
+    id: d17bee03-8687-46a7-831b-df48aacdea1e
     name: cluster-apps-k3s
   cloudflare:
     accountId: "03f750691b4ad4d59aa4b7205adaa108"
     domain: makeitwork.cloud
     secret: cloudflare-api-credentials
     CLOUDFLARE_API_TOKEN: CLOUDFLARE_API_TOKEN
+    CLOUDFLARE_TUNNEL_CREDENTIAL_FILE: credentials.json
   fallbackTarget: http_status:404
   deployPatch: |
     spec: