fix: harden Cloudflare Tunnel repository setup

[LucaLin233]

Summary

• validate Cloudflare signing key as one primary key with pinned fingerprint and UID
• stage and commit key/source as one generation with strict path, type, ownership, mode, and source validation
• roll back old key/source on write, rename, APT probe/install, exit, or HUP/INT/TERM failure while preserving evidence
• retain legacy source migration and existing package/service behavior

Verification

• git diff --check
• find . -type f -name '*.sh' -print0 | xargs -0 -n1 bash -n
• dedicated Cloudflare suite: 54 PASS
• full suite under CI locale: 2754 PASS across 13 suites
• ShellCheck warning scope and repository error scope passed

Tests use fake curl/gpg/apt/systemctl commands. No real Cloudflare, APT source, server, or deployment operation was performed.

Intentionally left unmerged for independent LENS review.