docs: scope Cloudflare root agent guidance

[xnoto]

Summary

• retain Cloudflare DNS ownership boundaries
• align repository guidance with CI plans and headless MCP operation
• reduce the OpenCode overlay

Validation

• Pending PR CI.

[github-actions]

OpenTofu CI passed

View the workflow run.

Validation output (redacted, last 12000 characters)

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan