refactor: consolidate Cloudflare One skills

[irvinebroque]

Summary

This is an alternate version of #55 that keeps Cloudflare One coverage but changes the skill shape:

• Replaces 21 discrete Cloudflare One skills with two retrieval-first skills: cloudflare-one and cloudflare-one-migrations.
• Keeps important non-obvious operating context, migration safety gates, and gotchas.
• Removes product-documentation-style content that should be retrieved from developers.cloudflare.com, Cloudflare MCP docs, or current API schemas.

Rationale

PR #55 added about 6,000 lines across 21 separate Access, Gateway, Tunnel, CASB, DLP, risk, WAN, and migration skills. That structure makes skill activation and context use worse: many narrow skills can overlap, duplicate Cloudflare documentation, and load stale reference material that agents can already retrieve from canonical sources.

The intended use of Agent Skills is to add context the agent would otherwise lack, not to repackage public product docs. This version spends the skill context budget on workflow guidance, safety defaults, decision points, and non-obvious failure modes. Exact API fields, category IDs, dashboard paths, limits, and product behavior should be retrieved at task time.

This follows the canonical Agent Skills guidance:

• Anthropic Skill authoring best practices: https://platform.claude.com/docs/en/agents-and-tools/agent-skills/best-practices
• Agent Skills best practices: https://agentskills.io/skill-creation/best-practices

Both sources emphasize concise skills, avoiding content the model already knows or can retrieve, using progressive disclosure, and spending context on project-specific or non-obvious guidance.

What changed compared with #55

• Skill count drops from 21 Cloudflare One skills to 2.
• Final diff against main is 186 added lines instead of roughly 6,000.
• Product-specific implementation detail is replaced with retrieval-first instructions.
• The general skill covers Cloudflare One design, configuration, troubleshooting, and review across Access, Gateway, WARP, Tunnel, Magic WAN, DLP, CASB, device posture, and identity.
• The migration skill covers Zscaler ZIA/ZPA, Palo Alto, legacy VPN/SWG, and SASE migration workflow.
• Important context retained from the original PR includes SCIM/group pitfalls, split tunnel and virtual network failure modes, TLS/DLP sequencing, CASB operational behavior, Magic WAN syntax differences, and migration completeness gates.

Validation

• Validated all skills/*/SKILL.md frontmatter with Ruby YAML parsing.
• Ran git diff --check.
• Checked whitespace for the two new skill files.

[irvinebroque]

Suggested change

- Use fully qualified MCP tool names when MCP tools are available.