skill: package cloudflare/skills into dockyard

[JAORMX]

Package agent skills from cloudflare/skills into the Dockyard registry.

Source

• Repo: https://github.com/cloudflare/skills
• License: Apache-2.0
• Upstream HEAD (at survey time): 0397d7d (2026-04-16)
• Skill count upstream: ~9
• Trust signal: Cloudflare named Anthropic skills launch partner

Candidate skills

• skills/cloudflare
• skills/workers-best-practices
• skills/wrangler
• skills/durable-objects
• skills/sandbox-sdk
• skills/agents-sdk
• skills/web-perf
• skills/cloudflare-email-service

Exact paths to confirm at packaging time.

Acceptance criteria

• One spec.yaml per selected skill under skills/<name>/
• spec.ref pinned to an audited upstream commit SHA
• task validate-skill passes for each
• task scan-skill findings triaged
• Single PR grouping all Cloudflare skills (branch skills/cloudflare)

Part of the vendor-by-vendor sweep following #466 (Trail of Bits).