Add Cloudflare sandboxes with Tailscale SSH

.github/workflows/cloudflare.yml

@@ -0,0 +1,28 @@
+name: Validate Cloudflare Sandbox
+
+on:
+  pull_request:
+    paths:
+      - deploy/cloudflare/**
+      - .github/workflows/cloudflare.yml
+
+permissions:
+  contents: read
+
+jobs:
+  worker:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: deploy/cloudflare
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          cache: npm
+          cache-dependency-path: deploy/cloudflare/package-lock.json
+      - run: npm ci
+      - run: npm run check
+      - run: npm test
+      - run: npx wrangler deploy --dry-run

deploy/cloudflare/.gitignore

@@ -0,0 +1,2 @@
+node_modules/
+.wrangler/

deploy/cloudflare/Dockerfile

@@ -0,0 +1,10 @@
+FROM tailscale/tailscale:v1.102.5 AS tailscale
+FROM ubuntu:24.04
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends bash ca-certificates sudo jq git gh openssh-server \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=tailscale /usr/local/bin/tailscale /usr/local/bin/tailscaled /usr/local/bin/
+
+CMD ["sleep", "infinity"]