feat: harden cflan for public review

[xnoto]

Summary

Hardens the NetworkManager-to-Cloudflare DNS update path while preserving the existing root/volume configuration contract.

• adds preferred /cflan_vars.yaml and /cflan_sops_vars.yaml names, while retaining /vars.yaml and /sops_vars.yaml as supported aliases;
• migrates to the supported Cloudflare Python client API and changes updates from delete-and-create to PATCH;
• validates configuration, record selection, and unsafe IPv4 inputs before API use;
• adds coverage for aliases, validation, duplicate records, idempotency, and no-delete updates;
• adds package build/install verification plus contributor, security, and changelog documentation.

Fixes: N/A (review-driven hardening)

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited

CI is the validation authority. No workstation installation, NetworkManager hook, SOPS decryption, or live Cloudflare DNS update was run. PR checks must validate tests, mypy, hooks, and package build/install.

Impact and rollout

Canonical producer: makeitworkcloud/cflan; no in-organization source consumer was found. This PR changes authored source only.

The installed-path compatibility contract is preserved: an existing root/volume /vars.yaml or /sops_vars.yaml remains readable. A future installation may instead supply the preferred matching /cflan_vars.yaml or /cflan_sops_vars.yaml. Publishing this PR does not install the new script, alter a root-volume file, invoke NetworkManager, or change a Cloudflare DNS record. Installation and functional verification remain manual, separate stages.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes

Rollback is a source rollback before a later installation. The existing root-volume aliases remain supported to prevent an immediate configuration migration. This change was materially produced by an AI agent and requires normal maintainer review.