V3 Cloudflare Tunnel capability pack. The callable surface is a by-value cli composition, not a service ingredient: recipes launch `cloudflared tunnel run <tunnel_name>` as a Recued-managed detached job and reconcile marker/log/pid evidence from the declared result directory. Two postures for the long-running tunnel: enroll it from pack-detail as a supervised daemon (the op declares supervision — restart-on-crash + re-launch-on-server-start), or launch it fire-and-forget from a recipe as a D-179 user-space job that records marker/log/pid evidence, with silent death detected by downstream sweeper recipes through missing or non-zero marker evidence. Requires the cloudflared binary on PATH and a pre-created tunnel.