feat(cloudflare/ruleset): add Ruleset resource

[agcty]

Adds a first-class Cloudflare Ruleset resource for zone phase entrypoints.

• supports zone-scoped phase entrypoint ownership via rulesets.putPhas
• accepts { zoneId }, zone ID strings, and hostname strings for zone selection
• clears the owned phase entrypoint on destroy
• adds a focused live test gated by CLOUDFLARE_TEST_RULESET_ZONE_ID
• registers Ruleset in the Cloudflare provider collection

Depends on alchemy-run/distilled#257 for generated Rulesets phase path support.

Verification run:

• bun vitest run packages/alchemy/test/Cloudflare/Ruleset/Ruleset.test.ts
• bun tsc -b --pretty false
• git diff --check

[agcty]

Verification update:

• Focused test passes without live env: bun vitest run packages/alchemy/test/Cloudflare/Ruleset/Ruleset.test.ts (skipped as expected).
• Typecheck passed: bun tsc -b --pretty false.
• Live test is currently blocked by fix(cloudflare/rulesets): support phase entrypoint paths distilled#257. With the currently installed @distilled.cloud/[email protected], the generated rulesets client calls /{accountOrZone}/{accountOrZoneId}/rulesets/phases/..., and Cloudflare returns No route for that URI. This is the exact path-generation bug fixed in the Distilled PR, so I am leaving this PR draft until that dependency is available here or otherwise linked for an end-to-end live run.

[agcty]

Marking this ready for review now. One dependency remains for full live-test verification: alchemy-run/distilled#257 needs to land or be otherwise consumed by this repo so the generated Rulesets client uses the correct phase-entrypoint path. The current implementation and focused tests are ready for review, and the live-test blocker is documented above.