feat: CloudGuard CLI — standalone Cloudflare domain security tool

Rust CLI built with clap providing:
- cloudguard audit: compliance check against hardening policy (16 constraints)
- cloudguard harden: apply security settings with --dry-run support
- cloudguard sync download: offline config export to JSON
- cloudguard dns list|add|delete|bulk-add: DNS management + security templates
- cloudguard zones list|status: zone inventory
- JSON output mode (--format json) for CI/CD automation
- Rate-limited CF API client (333ms interval)
- Auth via CLOUDFLARE_API_TOKEN env or ~/.config/cloudguard/credentials

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: hyperpolymath

.clinerules

@@ -0,0 +1,43 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>
+# Authoritative source: docs/AI-CONVENTIONS.md
+
+# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/STATE.a2ml.
+
+# LICENSE
+# All original code: PMPL-1.0-or-later.
+# Never AGPL-3.0. MPL-2.0 only as platform-required fallback.
+# SPDX header required on every source file.
+# Copyright: {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>
+
+# STATE FILES (.machine_readable/ ONLY)
+# Never create in repo root: STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml,
+# AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml.
+# The .machine_readable/ directory is the single source of truth.
+
+# BANNED PATTERNS
+# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO
+# Haskell: unsafeCoerce, unsafePerformIO, undefined, error
+# OCaml: Obj.magic, Obj.repr, Obj.obj
+# Coq: Admitted
+# Lean: sorry
+# Rust: transmute (unless FFI with // SAFETY: comment)
+
+# BANNED LANGUAGES
+# TypeScript -> ReScript
+# Node.js / npm / bun -> Deno
+# Go -> Rust
+# Python -> Julia or Rust
+
+# CONTAINERS
+# Runtime: Podman (never Docker).
+# File: Containerfile (never Dockerfile).
+# Base: cgr.dev/chainguard/wolfi-base:latest or cgr.dev/chainguard/static:latest.
+
+# ABI/FFI
+# ABI: Idris2 with dependent types (src/abi/).
+# FFI: Zig with C ABI (ffi/zig/).
+# Headers: generated/abi/.
+
+# BUILD: Use just (justfile) for all tasks.
+# STYLE: Descriptive names. Document all files. SPDX headers everywhere.

.cursorrules

@@ -0,0 +1,47 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>
+# Authoritative source: docs/AI-CONVENTIONS.md
+
+# Read 0-AI-MANIFEST.a2ml in the repo root FIRST for canonical file locations.
+
+# LICENSE
+# All original code: PMPL-1.0-or-later (SPDX header required on every file).
+# Never use AGPL-3.0. Fallback to MPL-2.0 only when platform requires it.
+# Copyright: {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>
+
+# STATE FILES
+# .a2ml metadata files go in .machine_readable/ ONLY.
+# Never create STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, AGENTIC.a2ml,
+# NEUROSYM.a2ml, or PLAYBOOK.a2ml in the repository root.
+
+# BANNED PATTERNS
+# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO
+# Haskell: unsafeCoerce, unsafePerformIO, undefined, error
+# OCaml: Obj.magic, Obj.repr, Obj.obj
+# Coq: Admitted
+# Lean: sorry
+# Rust: transmute (unless FFI with // SAFETY: comment)
+
+# BANNED LANGUAGES
+# TypeScript -> use ReScript
+# Node.js / npm / bun -> use Deno
+# Go -> use Rust
+# Python -> use Julia or Rust
+
+# CONTAINERS
+# Runtime: Podman (never Docker)
+# File: Containerfile (never Dockerfile)
+# Base: cgr.dev/chainguard/wolfi-base:latest
+
+# ABI/FFI STANDARD
+# ABI definitions: Idris2 with dependent types (src/abi/)
+# FFI implementation: Zig with C ABI (ffi/zig/)
+# Generated C headers: generated/abi/
+
+# BUILD SYSTEM
+# Use just (justfile) for all build, test, lint, and format tasks.
+
+# CODE STYLE
+# Use descriptive variable names.
+# Annotate and document all files.
+# Add SPDX-License-Identifier header to every source file.

.devcontainer/Containerfile

@@ -0,0 +1,32 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>
+#
+# Dev Container image for {{PROJECT_NAME}}
+# Base: Chainguard Wolfi (minimal, supply-chain-secure)
+# Build: podman build -t {{PROJECT_NAME}}-dev -f .devcontainer/Containerfile .
+
+FROM cgr.dev/chainguard/wolfi-base:latest
+
+# Install common development tools
+RUN apk update && apk add --no-cache \
+    bash \
+    curl \
+    git \
+    openssh-client \
+    ca-certificates \
+    build-base \
+    posix-libc-utils \
+    shadow \
+    && rm -rf /var/cache/apk/*
+
+# Create non-root dev user (matches devcontainer.json remoteUser)
+RUN groupadd -g 1000 nonroot || true \
+    && useradd -m -u 1000 -g 1000 -s /bin/bash nonroot || true
+
+# Set workspace directory
+WORKDIR /workspaces/{{PROJECT_NAME}}
+
+# Default shell
+ENV SHELL=/bin/bash
+
+USER nonroot

.devcontainer/README.adoc

@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
+= Dev Container Usage
+:author: {{AUTHOR}} <{{AUTHOR_EMAIL}}>
+
+== Overview
+
+This dev container uses `cgr.dev/chainguard/wolfi-base` with git, curl, bash, and just pre-installed. Dev container features add git, just, and nickel automatically.
+
+== VS Code (Local)
+
+. Install the *Dev Containers* extension (`ms-vscode-remote.remote-containers`).
+. Set `dev.containers.dockerPath` to `podman` in VS Code settings.
+. Open the repo folder, then choose **Reopen in Container** from the command palette.
+
+== GitHub Codespaces
+
+. From the repository on GitHub, click **Code > Codespaces > New codespace**.
+. The container builds automatically from this configuration.
+
+== Gitpod
+
+. Prefix the repo URL with `https://gitpod.io/#` to launch a workspace.
+. Gitpod reads `devcontainer.json` and builds the environment.
+
+== Customization
+
+Replace `{{PROJECT_NAME}}` placeholders in both `devcontainer.json` and `Containerfile` with your actual project name. Run `just deps` to verify the environment after first launch.

.devcontainer/devcontainer.json

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
+// Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>
+//
+// Dev Container configuration for {{PROJECT_NAME}}
+// Works with: VS Code Dev Containers, GitHub Codespaces, Gitpod
+// Container runtime: Podman (recommended) or any OCI-compliant runtime
+{
+  "name": "{{PROJECT_NAME}}",
+
+  "build": {
+    "dockerfile": "Containerfile",
+    "context": ".."
+  },
+
+  "features": {
+    "ghcr.io/devcontainers/features/git:1": {
+      "ppa": false,
+      "version": "latest"
+    },
+    "ghcr.io/jdx/devcontainer-features/just:1": {},
+    "ghcr.io/nickel-lang/devcontainer-feature:0": {}
+  },
+
+  "postCreateCommand": "just deps",
+
+  "remoteUser": "nonroot",
+
+  "containerEnv": {
+    "EDITOR": "code --wait",
+    "LANG": "C.UTF-8"
+  },
+
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "EditorConfig.EditorConfig",
+        "eamodio.gitlens",
+        "streetsidesoftware.code-spell-checker",
+        "timonwong.shellcheck",
+        "tamasfe.even-better-toml",
+        "skellock.just",
+        "redhat.vscode-yaml",
+        "DavidAnson.vscode-markdownlint",
+        "asciidoctor.asciidoctor-vscode",
+        "usernamehw.errorlens"
+      ],
+      "settings": {
+        "editor.formatOnSave": true,
+        "editor.insertSpaces": true,
+        "editor.tabSize": 2,
+        "files.trimTrailingWhitespace": true,
+        "files.insertFinalNewline": true,
+        "files.trimFinalNewlines": true,
+        "[makefile]": {
+          "editor.insertSpaces": false
+        }
+      }
+    },
+    "codespaces": {
+      "openFiles": [
+        "README.adoc"
+      ]
+    }
+  },
+
+  "forwardPorts": [],
+
+  "shutdownAction": "stopContainer"
+}

.editorconfig

@@ -0,0 +1,65 @@
+# RSR-template-repo - Editor Configuration
+# https://editorconfig.org
+
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 2
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.adoc]
+trim_trailing_whitespace = false
+
+[*.rs]
+indent_size = 4
+
+[*.ex]
+indent_size = 2
+
+[*.exs]
+indent_size = 2
+
+[*.zig]
+indent_size = 4
+
+[*.ada]
+indent_size = 3
+
+[*.adb]
+indent_size = 3
+
+[*.ads]
+indent_size = 3
+
+[*.hs]
+indent_size = 2
+
+[*.res]
+indent_size = 2
+
+[*.resi]
+indent_size = 2
+
+[*.ncl]
+indent_size = 2
+
+[*.rkt]
+indent_size = 2
+
+[*.scm]
+indent_size = 2
+
+[*.nix]
+indent_size = 2
+
+[Justfile]
+indent_style = space
+indent_size = 4
+

.envrc

@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# Activate development environment
+# Install direnv: https://direnv.net/
+
+# Load .tool-versions if asdf is available
+if has asdf; then
+  use asdf
+fi
+
+# Load Guix shell if guix.scm exists
+if has guix && [ -f guix.scm ]; then
+  use guix
+fi
+
+# Load Nix flake if flake.nix exists
+if has nix && [ -f flake.nix ]; then
+  use flake
+fi
+
+# Project environment variables
+export PROJECT_NAME="{{PROJECT_NAME}}"
+export RSR_TIER="infrastructure"
+# export DATABASE_URL="..."
+# export API_KEY="..."
+
+# Source .env if it exists (gitignored)
+dotenv_if_exists

.gitattributes

@@ -0,0 +1,54 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# RSR-compliant .gitattributes
+
+* text=auto eol=lf
+
+# Source
+*.rs    text eol=lf diff=rust
+*.ex    text eol=lf diff=elixir
+*.exs   text eol=lf diff=elixir
+*.jl    text eol=lf
+*.res   text eol=lf
+*.resi  text eol=lf
+*.ada   text eol=lf diff=ada
+*.adb   text eol=lf diff=ada
+*.ads   text eol=lf diff=ada
+*.hs    text eol=lf
+*.chpl  text eol=lf
+*.scm   text eol=lf
+*.ncl   text eol=lf
+*.nix   text eol=lf
+
+# Docs
+*.md    text eol=lf diff=markdown
+*.adoc  text eol=lf
+*.txt   text eol=lf
+
+# Data
+*.json  text eol=lf
+*.yaml  text eol=lf
+*.yml   text eol=lf
+*.toml  text eol=lf
+
+# Config
+.gitignore     text eol=lf
+.gitattributes text eol=lf
+Justfile       text eol=lf
+Makefile       text eol=lf
+Containerfile  text eol=lf
+
+# Scripts
+*.sh   text eol=lf
+
+# Binary
+*.png   binary
+*.jpg   binary
+*.gif   binary
+*.pdf   binary
+*.woff2 binary
+*.zip   binary
+*.gz    binary
+
+# Lock files
+Cargo.lock  text eol=lf -diff
+flake.lock  text eol=lf -diff

.github/CODEOWNERS

@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
+# CODEOWNERS - Define code review assignments
+# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+#
+# Replace {{OWNER}} with your GitHub username or team
+
+# Default owners for everything
+* @{{OWNER}}
+
+# Security-sensitive files require explicit review
+SECURITY.md @{{OWNER}}
+.github/workflows/ @{{OWNER}}
+Trustfile.a2ml @{{OWNER}}
+.machine_readable/ @{{OWNER}}