Add a program for lego's exec DNS provider

contrib/lego/jarl-lego.sh turns lego's "present|cleanup FQDN VALUE" calls
into jarl acme set|unset --exact, so lego (and CNAME delegation to a
dedicated ACME zone) works with Jarl. docs/acme.md explains the setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -24,6 +24,9 @@ The first version, to be released as 0.1.0.
   the web UI. Networks smaller than a /24 explain that they belong in the
   enclosing /24's zone.
 - docs/operations.md: setting up a secondary server with its own jarld.
+- lego support: `contrib/lego/jarl-lego.sh` is a program for lego's `exec`
+  DNS provider that publishes DNS-01 challenges through `jarl acme`,
+  including challenge names reached through a CNAME (docs/acme.md).
 - docs/concepts.md: what each zone type does, what to enter as a new zone's
   name servers (and when glue addresses are needed), how reverse zones map
   to networks, and why dynamic updates give way to API tokens.