hermes - 💡(How to fix) Fix Execute Domain and Cloudflare Status Checks With Read-Only Guard [1 participants]

What to build

Add a guarded executor slice for domain and Cloudflare status checks. L can check domain or Cloudflare state only through read-only sources and must not change DNS, proxy state, nameservers, or production configuration.

Acceptance criteria

• L can identify pending fresh_data/status_check work items with check_source=cloudflare or domain.
• Execution is read-only and refuses mutation paths such as DNS changes, proxy toggles, deployment, or nameserver edits.
• Missing credentials or unclear source blocks the work item and explains what Leo must provide.
• The result records source checked, status, confidence, and whether human confirmation is still needed.
• Tests cover read-only success, missing permission, and refusal to mutate production state.

Blocked by

• #24892