[kale-stew]

What

Adds a short "Troubleshoot HTTP errors on a proxied site" section to the cloudflare skill, and extends the skill description so it loads when a user reports a Cloudflare error page, a 52x status, a 1xxx error code, or a Cloudflare 403.

The section is decision rules only. Each rule links the troubleshooting page that holds the facts:

• 502 and 504: branding reverses the usual reading (branded means the origin returned it).
• Other errors: read the cf-error-type diagnostic header, and keep "who generated the page" separate from "where the fix belongs".
• 1xxx codes: Cloudflare generated the response; map the code to its HTTP status with the docs table. 10xxx codes are API errors.
• 520–526: start at the origin; for 525/526, also check the SSL/TLS mode.
• 403: check the page first; for 1020 or the WAF block page, search Security Events (sampled) for the rule.
• Visitors can't fix most of these; send them to the site owner.

It also tells the agent to retrieve the page for the specific code instead of answering from memory, and to ask about Custom Errors before relying on branding.

Why

Agents asked about an error on a proxied site had no guidance for deciding whether to fix Cloudflare configuration or the origin, and tend to answer from memory. The underlying docs were corrected first (cloudflare/cloudflare-docs#34327, #34334, #34336), so the skill can link them rather than restate them.

Checks

• All 10 links return 200; the #http-status-codes anchor exists.
• Each rule was checked against the current text of the linked page.
• Description is 464 characters.
• Merge conflicts: the only open PR this adds a conflict to is Teach agents to use Access service tokens #98, which also appends a sentence to the cloudflare skill description. Keeping both sentences resolves it.