Import march-2020-03-10 from private repo (scrubbed 2026-05-27)

Targets Rec Room 2020.03.10 client (also serves 2020.03.06).

Re-import after adding:
- DorkNet.ClientMod/dorknet-clientmod.json.template — config schema
  the launcher's manifest-driven patcher renders into UserData/.
- tools/build-patcher-zip.ps1 — produces dorknet-clientpatch-{key}.zip
  for v1-march-* Release uploads.
- .github/workflows/release.yml — on tag push publishes both
  dorknet-server-march_2020_03_10-win-x64.zip and
  dorknet-clientpatch-march_2020_03_10.zip as Release assets.

Same scrub rules as december; tools/build-patcher-zip.ps1 added to
the maintainer-side allow-list so it survives.

tools/cloudflared-config.yml.template

@@ -0,0 +1,40 @@
+# DorkNet Cloudflare Tunnel config
+# ────────────────────────────────────────────────────────────────────
+# Routes every localhost subdomain through the tunnel into the local
+# server (HTTPS on port 443). Generated by tools/setup-cloudflared.ps1
+# — copy to %USERPROFILE%\.cloudflared\config.yml and replace the
+# {{TUNNEL_ID}} / {{CREDENTIALS_FILE}} placeholders.
+#
+# Origin TLS verify is OFF because the local server's wildcard cert is
+# from mkcert (a private CA trusted only on this machine). cloudflared
+# would reject it as untrusted otherwise. Traffic between cloudflared
+# and Cloudflare's edge is still TLS-encrypted; this only relaxes the
+# leg from cloudflared → localhost.
+
+tunnel: {{TUNNEL_ID}}
+credentials-file: {{CREDENTIALS_FILE}}
+
+# Ingress rules are evaluated top-down. The wildcard catches every
+# subdomain we don't list explicitly, so when the 2020 Rec Room client
+# (post-domain-patch) hits a niche subdomain like roomieintegrations.
+# localhost, the request still reaches the server.
+ingress:
+  - hostname: localhost
+    service: https://localhost:443
+    originRequest:
+      noTLSVerify: true
+      httpHostHeader: localhost
+
+  - hostname: "*.localhost"
+    service: https://localhost:443
+    originRequest:
+      noTLSVerify: true
+      # Forward the original Host header verbatim so the server's
+      # [Host("api.localhost")] etc. attributes match correctly.
+      # (cloudflared does this by default; setting it explicitly so
+      # config.yml is self-documenting.)
+
+  # Catch-all rejects anything that didn't match (defensive — the
+  # tunnel only routes traffic for hostnames we've added DNS records
+  # for, so this is rarely reached).
+  - service: http_status:404