Google issues each Domain property's google-site-verification token; this writes it as a TXT record at whichever host serves the apex (Cloudflare and Porkbun through the vault services, DigitalOcean through doctl). Dry run by default, --apply to write, add-only and idempotent. With no arguments it reports every apex's DNS host and whether a Google record is already there: aesthetic.computer, sotce.net, oskiewar.com and jas.life already carry one.