feat: integrate framework files into monorepo under packages/mosaic/framework/

Moves all Mosaic framework runtime files from the separate bootstrap repo
into the monorepo as canonical source. The @mosaic/mosaic npm package now
ships the complete framework — bin scripts, runtime configs, tools, and
templates — enabling standalone installation via npm install.

Structure:
  packages/mosaic/framework/
  ├── bin/          28 CLI scripts (mosaic, mosaic-doctor, mosaic-sync-skills, etc.)
  ├── runtime/      Runtime adapters (claude, codex, opencode, pi, mcp)
  ├── tools/        Shell tooling (git, prdy, orchestrator, quality, etc.)
  ├── templates/    Agent and repo templates
  ├── defaults/     Default identity files (AGENTS.md, STANDARDS.md, SOUL.md, etc.)
  ├── install.sh    Legacy bash installer
  └── remote-install.sh  One-liner remote installer

Key files with Pi support and recent fixes:
- bin/mosaic: launch_pi() with skills-local loop
- bin/mosaic-doctor: --fix auto-wiring for all 4 harnesses
- bin/mosaic-sync-skills: Pi as 4th link target, symlink-aware find
- bin/mosaic-link-runtime-assets: Pi settings.json patching
- bin/mosaic-migrate-local-skills: Pi skill roots, symlink find
- runtime/pi/RUNTIME.md + mosaic-extension.ts

Package ships 251 framework files in the npm tarball (278KB compressed).

packages/mosaic/framework/tools/cloudflare/_lib.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+#
+# _lib.sh — Shared helpers for Cloudflare tool scripts
+#
+# Usage: source "$(dirname "$0")/_lib.sh"
+#
+# Provides:
+#   CF_API                          — Base API URL
+#   cf_auth                         — Authorization header value
+#   cf_load_instance <instance>     — Load credentials for a specific or default instance
+#   cf_resolve_zone <name_or_id>    — Resolves a zone name to its ID (passes IDs through)
+
+CF_API="https://api.cloudflare.com/client/v4"
+
+cf_auth() {
+  echo "Bearer $CLOUDFLARE_API_TOKEN"
+}
+
+# Load credentials for a Cloudflare instance.
+# If instance is empty, loads the default.
+cf_load_instance() {
+  local instance="$1"
+  if [[ -n "$instance" ]]; then
+    load_credentials "cloudflare-${instance}"
+  else
+    load_credentials cloudflare
+  fi
+}
+
+# Resolve a zone name (e.g. "mosaicstack.dev") to its zone ID.
+# If the input is already a 32-char hex ID, passes it through.
+cf_resolve_zone() {
+  local input="$1"
+
+  # If it looks like a zone ID (32 hex chars), pass through
+  if [[ "$input" =~ ^[0-9a-f]{32}$ ]]; then
+    echo "$input"
+    return 0
+  fi
+
+  # Resolve by name
+  local response
+  response=$(curl -s -w "\n%{http_code}" \
+    -H "Authorization: $(cf_auth)" \
+    -H "Content-Type: application/json" \
+    "${CF_API}/zones?name=${input}&status=active")
+
+  local http_code
+  http_code=$(echo "$response" | tail -n1)
+  local body
+  body=$(echo "$response" | sed '$d')
+
+  if [[ "$http_code" != "200" ]]; then
+    echo "Error: Failed to resolve zone '$input' (HTTP $http_code)" >&2
+    return 1
+  fi
+
+  local zone_id
+  zone_id=$(echo "$body" | jq -r '.result[0].id // empty')
+
+  if [[ -z "$zone_id" ]]; then
+    echo "Error: Zone '$input' not found" >&2
+    return 1
+  fi
+
+  echo "$zone_id"
+}