Guide sender-domain writes to global lane

[rogu3bear]

Summary

• Marks sender_domain enable as a global-lane write in the surface catalog and capabilities matrix.
• Updates guide/classify to fall back to a single explicit policy lane when live lane comparison has no recommendation.
• Adds static contract coverage proving no-auth cfctl guide sender_domain enable emits global-lane preview/apply/verify commands.

Test plan

• Red first: ./scripts/verify_static_contract.sh failed on missing sender-domain global lane assertion
• env -u CF_DEV_TOKEN -u CF_GLOBAL_TOKEN -u CLOUDFLARE_API_TOKEN -u CLOUDFLARE_ACCOUNT_ID CF_SHARED_ENV_FILE=/nonexistent/cfctl-empty-env CF_REPO_ENV_FILE=/nonexistent/cfctl-empty-env ./cfctl guide sender_domain enable --zone example.com --name example.com
• env -u CF_DEV_TOKEN -u CF_GLOBAL_TOKEN -u CLOUDFLARE_API_TOKEN -u CLOUDFLARE_ACCOUNT_ID CF_SHARED_ENV_FILE=/nonexistent/cfctl-empty-env CF_REPO_ENV_FILE=/nonexistent/cfctl-empty-env ./cfctl classify sender_domain enable --zone example.com --name example.com
• bash -n commands/cfctl.sh scripts/lib/cfctl.sh cfctl
• git diff --check
• ./scripts/verify_static_contract.sh

Risk / review focus

• Confidence: high that this fixes the guide/classify mismatch without changing generic two-lane write guidance.
• Review focus: the fallback only uses policy lanes when the operation has exactly one allowed lane; verify that avoids over-prefixing normal dev,global writes.
• CI caveat: GitHub Actions for this repo is currently failing before runner steps/logs are recorded on main; local static contract is the meaningful proof for this change.

[rogu3bear]

@codex Please review the sender-domain lane guidance fallback. The part I am least certain about is whether falling back to a single explicit policy lane should live at the helper level or only in guide/classify.

[rogu3bear]

Local proof is green: red-first static assertion, no-auth guide/classify checks, bash syntax, diff check, capabilities regeneration, and full ./scripts/verify_static_contract.sh. GitHub Actions failed before runner steps/logs were recorded, matching the existing cfctl Actions startup-failure pattern on main.