Preserve explicit cfctl token lane

[rogu3bear]

Summary

• preserve caller-provided CF_TOKEN_LANE after shared/repo env files are sourced
• add a static-contract regression proving command-time global lane selection beats env-file defaults

Proof

• red first: ./scripts/verify_static_contract.sh failed with 'explicit CF_TOKEN_LANE was not preserved over env files'
• green after fix: ./scripts/verify_static_contract.sh
• live readback: CF_TOKEN_LANE=global ./cfctl list worker.script returned auth.lane=global and included jkca-web-book
• live readback: CF_TOKEN_LANE=global ./cfctl list worker.route --zone jkca.me returned auth.lane=global and jkca.me routes to jkca-web-edge-router

Notes

• no Cloudflare mutation, deploy, or route change was performed

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• scripts/lib/cloudflare.sh
• scripts/verify_static_contract.sh

---

_{Reviewed by grok-code-fast-1:optimized:free · 82,588 tokens}