Self-Healing Cloudflare CIDRs in DigitalOcean Firewalls

Hardcoded Cloudflare IP ranges in your DO firewall go stale every couple of years. Here's how to fetch them live in CI so drift is impossible.