Reconcile provider contracts and Cloudflare outputs

[zackbart]

Summary

• replace empty Cloudflare named-tool outputs with maintained schemas and projections
• accept the current R2 and KV jurisdiction contracts while preserving provider-added fields
• record the current Cloudflare bulk and zone-setting contracts
• pin Notion inequality-filter preservation with regression coverage
• align provider audit records and operations documentation with the current surface

Current-provider review

• Cloudflare's rendered zone-settings reference and current OpenAPI both include webmcp_enabled and webmcp_packs
• the latest KV bulk drift changes SDK metadata and confirmation guidance without changing the HTTP contract
• the recorded Cloudflare endpoint manifest is current across 49 tracked endpoints
• all 48 named Cloudflare tools now declare useful output keys; the three generic endpoint escape hatches remain intentionally open

Verification

• npm run check
• npm run check:security
• npm run check:package
• npm run drift:check -- --specs --provider cloudflare --provider notion
• targeted Cloudflare and Notion provider suites under both Node and workerd

Closes #488
Closes #498
Closes #499
Closes #500
Closes #501
Closes #502
Closes #503
Closes #504
Closes #509