Living in Terraform: alunduil.com after the Cloudflare migration

## Spark

This week the alunduil.com infrastructure migrated from click-ops Cloudflare and a legacy GCP Cloud DNS zone into Terraform: zone, DNSSEC end-to-end, blog Pages + repo + default branch all reified. Legacy GCP zone deleted post-apply. Every issue opened in `alunduil-infrastructure` this window has a closed-state or a merged PR.

## Why it could be interesting

The activity is "I terraformed my DNS." The underlying claim worth a post: **the high-leverage benefits of Terraform-managing personal infra aren't reproducibility (I'm one person; my laptop being the source of truth is fine) — they're (a) audit trail of *why* the zone is configured the way it is, (b) cheap rollback when an experiment breaks something, and (c) making "what should I delete?" answerable**. Deleting the legacy GCP zone was only safe to do because TF showed exactly what referenced it.

Distinct from #72 (Terraform *import skill*) — that's about getting *in*. This is about what changes once you're already in: which workflows get cheaper, which feel like overkill, and which create new source-of-truth problems. DNSSEC end-to-end is a useful concrete worked example because the hard part wasn't TF — it was the registrar coordination dance.

## Open questions

- [ ] What concretely got safer/easier vs. unchanged after migration? (Audit: 30 days of changes, was TF a help or a tax?)
- [ ] Where does TF still feel like overkill at the personal scale — single records, ad-hoc DNS for testing?
- [ ] DNSSEC end-to-end: what was the actually hard part — TF, or registrar coordination?
- [ ] Does a personal infra TF setup tip into "now I have two source-of-truth problems" (re: #68 settings with two owners)?

## Source material

- [infra#7](https://github.com/alunduil/alunduil-infrastructure/issues/7) — Manage blog.alunduil.com repo, Pages, and default branch in TF (closed)
- [infra#40](https://github.com/alunduil/alunduil-infrastructure/issues/40) — DNSSEC enabled end-to-end on alunduil.com (closed)
- [infra#36](https://github.com/alunduil/alunduil-infrastructure/issues/36) — Legacy GCP alunduil-com Cloud DNS zone deleted post-apply (closed)
- [infra#37](https://github.com/alunduil/alunduil-infrastructure/issues/37) — Cloudflare zone managed by Terraform
- [infra#42](https://github.com/alunduil/alunduil-infrastructure/pull/42) — Manage DNSSEC on alunduil.com via Terraform
- [infra#45](https://github.com/alunduil/alunduil-infrastructure/pull/45) — Bring alunduil.com Cloudflare zone under Terraform
- [infra#44](https://github.com/alunduil/alunduil-infrastructure/pull/44) — Audit README against the readme skill checklist
- [infra#35](https://github.com/alunduil/alunduil-infrastructure/issues/35) — HTTPS enforcement on Pages
- [infra#38](https://github.com/alunduil/alunduil-infrastructure/issues/38) — `var.repositories` evaluated for module extraction
- Related kernels: #72 (Terraform import skill), #68 (settings with two owners)