feat: n2n P2P overlay + fleet wizard — runner registration fix, Serveo removal, repo obfuscation overhaul (#5 followup)

[vi70x4]

Summary

Massive cleanup and hardening of the fleet deployment pipeline. Removes dead-end Serveo tunnel, fixes runner registration (the root cause of silent proxy failures), rewrites fork obfuscation to create fresh standalone repos instead of forking, and adds fake TypeScript source code generation so throwaway repos look like legitimate CI projects.

Changes

Core: Fix runner registration (was silently skipping)

• proxy.yml: Shell guard for COORDINATOR_URL instead of unreliable secrets. or env. context in if: conditionals
• proxy.yml: Debug diagnostics added to registration step (env var dump)
• proxy.yml: Shell guard for empty AUTH_TOKEN (exits with clear error instead of silent skip)
• Root cause: GitHub Actions does not reliably populate secrets.* or env.* in if: expressions at step evaluation time

Tunnel: Strip Serveo, default to trycloudflare

• proxy.yml: Removed Serveo entirely (30-line tunnel step deleted). HTTP-only free tier adds warning page — kills the proxy UX
• proxy.yml: Default tunnel changed from serveo → trycloudflare
• proxy.yml: VLESS transport selection simplified: only trycloudflare uses WebSocket, all others use raw TCP
• README.md: Stripped Serveo from tagline, connection modes table, when-to-use-what, project structure, FAQ. trycloudflare promoted to default
• AGENTS.md: docs fleet section updated

Fleet obfuscation: No more forks

• animamesh-fleet.sh add: Replaced gh repo fork animamesh/backend with gh repo create <name> — creates a fresh standalone repo with zero fork network. No "forked from animamesh/backend" badge visible
• create_minimal_repo(): New function replaces obfuscate_fork(). Builds repo from scratch with only the obfuscated workflow + README + fake source code
• 2-commit strategy: Commit 1 = "Initial commit" (skeleton). Commit 2 = "Add source code and CI workflow" (source + workflow). Looks organic
• gen_fake_source(): New function generates deterministic TypeScript utility files (4 variants, seeded by repo name). Includes package.json, tsconfig.json, jest.config.js, src/collect.ts, src/format.ts, src/__tests__/*.test.ts. Zero mentions of proxy/VPN/mesh/tunnel
• Repo names: Updated GENERATED_NAMES from library names (csv-parse, date-fmt) to CI-sounding names (ci-config, build-workflows, task-runner)
• README generation: LLM prompt now describes a CI pipeline repo, not a utility library

Coordinator deployment via GHA

• meshify-wizard.sh: Added option to deploy the Worker via GitHub Actions (creates a temp repo, pushes code, lets GHA run wrangler deploy). Workaround for local wrangler deploy hang bug
• wrangler.toml: Smart Placement disabled (was causing deploy hang). KV namespace id documented as placeholder

Documentation

• AGENTS.md: Added "Fleet Architecture — Multi-Account Matrix" section covering account naming, storage layout, fleet management workflow, shared coordinator model, repo obfuscation strategy, Cloudflare integration plan, auth matrix, and operational notes
• AGENTS.md: Original "Fork Obfuscation" section rewritten as "Repo Obfuscation Strategy" with fresh-repo approach
• README.md: Reflects all tunnel/doc changes

Questions for Gemini reviewer

1. Two-layer trust model — Is the explanation (n2n key = WiFi WPA2, Hy2 password = router admin) clear enough? Any gaps in the threat model for the n2n + Hysteria2 architecture?

2. Fake source code obfuscation — The gen_fake_source() function generates deterministic TypeScript utility files based on a repo-name seed. Is this over-engineered? Could a simpler approach (just a real-looking README + empty package.json) achieve the same obfuscation effect, or does the fake code meaningfully reduce suspicion?

3. Fresh repo vs fork — By creating standalone repos instead of forking, we lose the ability to pull upstream changes. Each repo must be independently maintained. Is this tradeoff worth the opsec gain (no "forked from animamesh" badge)? Should we add a periodic sync mechanism?

4. 2-commit strategy robustness — The "Initial commit" + "Add source code and CI workflow" commit sequence could cause merge conflicts if the remote repo has changed between gh repo create and git push. We handle this with --force via delete-then-create, but should we use force-push as a fallback instead?

5. Dashboard repurpose — The TODO.md plans to migrate the Express/Socket.IO dashboard onto the Cloudflare Worker. The 1MB Worker size limit is a constraint. Should we use Cloudflare Workers Assets (newer, hosts static files on edge CDN) or inline everything?

6. gen_readme() LLM fallback — Relies on http://localhost:3001/v1/chat/completions with a hardcoded API key. The static fallback is the actual guarantee. Should we make the LLM URL/KEY configurable via env vars for end users who run local models?

7. Workflow secret obfuscation — The proxy.yml step names are renamed to generic CI terms. However, the run: blocks still contain commands like sudo apt-get install n2n, sing-box run, cloudflared tunnel. The step names are what appear in the GitHub UI — is this sufficient, or should we also obfuscate the echo/log messages inside the run blocks?

Applied from Gemini review

• git config safety: Added / before commits — no dependency on user's global git config
• Auth security: Replaced embedded token in remote URL () with — token not visible in if script crashes
• Force push fallback: branch 'main' set up to track 'origin/main'. as retry — repo was just created, no legitimate conflicts possible
• sed compatibility: Dropped GNU-only I flag from comment-stripping patterns — uses case-sensitive matching (casing is known/consistent)

Applied from Gemini review

• git config safety: Added git config user.name "CI Bot" / git config user.email "bot@ci.local" before commits — no dependency on user's global git config
• Auth security: Replaced embedded token in remote URL with http.extraHeader — token not visible in .git/config if script crashes
• Force push fallback: git push -u origin main --force as retry — repo was just created, no legitimate conflicts possible
• sed compatibility: Dropped GNU-only I flag from comment-stripping patterns — uses case-sensitive matching (casing is known/consistent)