Declaratively onboard the Cloudflare repository

[devantler]

🤖 Generated by the Agentic Engineer

Blocker: crossplane-contrib/provider-upjet-github v0.20.0 package publication (must exist in the consumed registry before Repository updates are safe) | upstream | last-verified 2026-09-19: source tag v0.20.0 embeds terraform-provider-github v6.13.0, but no v0.20.0 package exists in GHCR or xpkg

Context

devantler-tech/cloudflare is now a portfolio repository and the maintainer requested public visibility in #200. It is absent from every rendered GitHub-as-code dimension, so that visibility is not yet continuously enforced. An Observe-only declaration would document public intent but would not enforce it, and including it under the current shared Repository patch would also declare merge settings that differ from live while the deployed provider cannot safely update them.

Required delivery

1. Verify a published provider-upjet-github package embeds terraform-provider-github v6.12.0 or later, and deploy that reviewed package through the platform owner.
2. Observe-adopt cloudflare with crossplane.io/external-name, explicit visibility: public, archived: false, and its live description.
3. Declare all required dimensions: Repository, authoritative IssueLabels, Maintainers/Admins team grants, and any active repository-permissions surface. Enumerate live labels first so adoption cannot delete labels in use.
4. After Synced/Ready observation evidence, promote the Repository to Observe/Create/Update without Delete or LateInitialize.
5. Align the repository with the shared squash-only policy and verify the GitHub API, managed-resource conditions, and the scheduled drift check all agree.

Acceptance criteria

• A published and deployed provider package contains the signoff fix.
• cloudflare is present in every required rendered declarative dimension without exemptions.
• Visibility is declared and enforced as public.
• The Repository is Synced/Ready under Observe/Create/Update and excludes Delete/LateInitialize.
• Live merge settings match the shared squash-only declaration.
• Repository drift and declarative-coverage checks are green.

Blocked by the named upstream package publication, not by maintainer authority.