Repair cfctl Email Routing control-plane workflow

[rogu3bear]

Summary

• repair cfctl can email.routing_rule parsing, token-lane selection, and zone-resolution diagnostics so Email Routing probes report actionable state instead of falling through to bad requests or credential noise
• make Email Routing upserts fail closed when the preflight read is unavailable or a recipient selector is ambiguous, and extend the static/public contracts around these behaviors
• document the Email Routing control-plane model, fold in the shared-alias retry guard, and preserve the adapterOS Access desired-state files from the dirty checkout in this single branch
• preflight the public-contract smoke zone against the active token lane so wrong-lane runs fail early with a clear remediation
• redact doctor secret-scan sample text so doctor artifacts cannot poison later secret scans or encourage unsafe grep output

Test plan

• git diff --check
• bash -n commands/cfctl.sh scripts/lib/cfctl.sh scripts/cf_mutate_email_routing_rule.sh scripts/normalize_secondary_shared_aliases.sh scripts/verify_static_contract.sh scripts/verify_public_contract.sh
• jq empty state/access.app/beta-adapteros.json state/access.app/ops-adapteros.json catalog/surfaces.json catalog/runtime.json
• shellcheck scripts/cf_mutate_email_routing_rule.sh scripts/normalize_secondary_shared_aliases.sh scripts/verify_public_contract.sh
• ./scripts/verify_static_contract.sh
• ./cfctl doctor --repair-hints reports healthy dev/global lanes, no secret leaks, and expired_preview_count: 0
• CF_TOKEN_LANE=global ./cfctl can email.routing_rule --zone windowdrop.pro
• CF_TOKEN_LANE=global ./cfctl can email.routing_rule upsert --zone windowdrop.pro --name test@windowdrop.pro --service star-maildesk-cf-router --all-lanes
• CF_TOKEN_LANE=global ./cfctl list email.routing_rule --zone windowdrop.pro
• CFCTL_PUBLIC_CONTRACT_ZONE=windowdrop.pro ./scripts/verify_public_contract.sh fails early with a lane/zone visibility error on the default dev lane
• CF_TOKEN_LANE=global CFCTL_PUBLIC_CONTRACT_ZONE=windowdrop.pro ./scripts/verify_public_contract.sh

Notes

• /Users/star/dev/cloudflare has been reconciled back to clean main. The prior dirty state was captured locally under /Users/star/dev/cloudflare/var/reconciliation/20260613T173830Z-ops-hide-strategy-files/ before cleanup.
• The local runtime-artifact cleanup that removed old raw doctor/env artifacts was captured under /Users/star/dev/cloudflare/var/reconciliation/20260613T194006Z-runtime-artifact-redaction-cleanup/.
• PR CI reports static contract passing; the live Cloudflare contract is skipped on pull requests by the workflow gate.