The Cloudflare Tunnel That Stopped Resolving at 3AM

A transient DNS failure restarted my Cloudflare Tunnel and left it running but unreachable. Here's how I tracked it down, and the health checks, systemd hardening, and DNS redundancy I added to stop it happening again.