Create one ad-hoc Cloudflare DNS record on an existing zone. Use for a single extra record; awf-setup-domain creates the zone and the standard apex/www records. Writes the record ID into passport.json (cloudflare["<TYPE>:<name>"]). Idempotent — re-running with the same inputs is a no-op.
