perf: reduce manager binary size

[gi8lino]

What changed

• replace the root cloudflare.Client with a small local client containing only the DNS and Zones services used by the operator
• construct Cloudflare request fields directly so production code no longer imports the root SDK package for convenience helpers
• update controller call sites and the shared test client fixture to use the scoped client

Why

cloudflare.NewClient constructs every generated Cloudflare API service. The operator only uses DNS and Zones, but the root client made all of those service packages reachable in the manager binary.

For a stripped Linux/amd64 build using Go 1.26.5:

	Bytes
Before	56,856,738
After	45,289,634
Saved	11,567,104 (20.3%)

The non-standard production dependency closure drops from 771 to 654 packages.

Validation

• go vet ./...
• credential-independent controller tests
• all non-e2e, non-controller packages
• CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags='-s -w' ./cmd
• git diff --check

The full make test target reaches the Cloudflare integration cases, which require local CF_API_TOKEN and zone test credentials; those were not available in this environment. The repository's golangci-lint installer also stopped on an upstream archive checksum mismatch before linting began.

[rxbn]

The scoped-client approach is a good optimization. I independently reproduced the roughly 20% reduction in both stripped and Dockerfile-style builds, and the full CI/e2e coverage is green. Requesting changes only for the timeout regression noted inline. Once a bounded Cloudflare request/response timeout is restored and CI passes again, I would be comfortable merging this.