docs(runbook): add Cloudflare wiki policy controls

[ss-o]

Summary

• Give maintainers a read-only-first procedure for inspecting Cloudflare Pages, AI Crawl Control, analytics, and request-log capabilities that affect the public wiki.
• Separate public-safe evidence from restricted account data, and compare deployed behavior with repository-owned crawler and Content-Signal policy.
• Require target-specific maintainer approval, known-good deployment evidence, rollback verification, and forward restoration before any production mutation.

Verification

• CI=true trunk check --no-fix --filter=-gitleaks runbooks/cloudflare-wiki-policy.md
• python3 scripts/validate-agent-policy.py
• python3 -m unittest scripts/test_validate_agent_policy.py -v
• Exercised the documented public header checks across five production endpoints and one manifest-declared HTML/Markdown pair.
• Confirmed the public manifest shape, crawler policy, and repository source links. The full Trunk run could not invoke its cached gitleaks binary locally.

Instruction impact review

1. Classification: This is scoped, canonical operational guidance, not shared organization policy, a runtime adapter, or enforcement logic.
2. Consumers and contexts: Codex, Claude Code, Copilot, Gemini CLI, and maintainers receive it when performing Cloudflare wiki-policy inspection or Pages rollback work in z-shell/.github.
3. Canonical owner: runbooks/cloudflare-wiki-policy.md is the correct canonical owner for this procedure.
4. Duplication or conflict: No conflicting owner was found. .github/instructions/mcp-plugins.instructions.md remains capability guidance; the runbook owns the operational procedure.
5. Manifest routing: .github/instruction-surfaces.json now routes the runbook for cloudflare-wiki-policy and cloudflare-pages-rollback tasks.
6. Runtime delivery: The required manifest route covers every supported runtime without relying on an optional Cloudflare connector, hook, or skill.
7. Generated output and limits: No generated output or adapter changed. The public validator and all 70 policy unit tests pass.

Agent handoff

No handoff needed.

Fixes: #459

[Copilot]

Pull request overview

Adds a new organization runbook that helps maintainers inspect Cloudflare controls affecting the public Z-Shell wiki (read-only by default), compare deployed behavior against repository-owned crawler/Content-Signal policy, and safely execute/verify a Pages rollback and forward restoration when explicitly approved.

Changes:

• Introduces a read-only-first inspection procedure covering Pages deployments, AI Crawl Control, analytics, and logging surfaces.
• Documents a public-safe evidence template and a clear security/privacy boundary for what can be recorded publicly vs. restricted systems.
• Defines a rollback decision checklist, approval requirements, and post-change verification/restoration steps.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

runbooks/cloudflare-wiki-policy.md:41

• The security boundary section allows publishing “public response headers” (lines 31–33), but this bullet forbids publishing “request or response headers” (lines 40–41). That reads as a contradiction and could cause operators to avoid recording the specific public headers the runbook later requires.

Consider narrowing this bullet to prohibit raw headers captured from general-traffic logs (or other restricted sources), while still allowing the small public-safe header subset from explicit curl checks.

- client IP addresses, cookies, request or response headers, referrers, or raw
  user-agent strings from general traffic; or

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

runbooks/cloudflare-wiki-policy.md:72

• The “public-safe template” is shown inside a fenced ```text block, but it contains a Markdown table. If someone pastes it verbatim into an issue, the table won’t render and is harder to read; the runbook should explicitly say to remove the code fence (or otherwise paste it as Markdown) so the table renders.

Copy this public-safe template:

```text