Add a program for lego's exec DNS provider

contrib/lego/jarl-lego.sh turns lego's "present|cleanup FQDN VALUE" calls
into jarl acme set|unset --exact, so lego (and CNAME delegation to a
dedicated ACME zone) works with Jarl. docs/acme.md explains the setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/acme.md

@@ -79,7 +79,36 @@ remembers `JARL_SERVER`, `JARL_TOKEN`, `JARL_VIEW` (optional) and `JARL_BIN`
 (path to jarl, optional) in acme.sh's account configuration for renewals.
 When they are unset, jarl's own configuration file is used.
 
-## 5. A dedicated ACME zone (CNAME delegation)
+## 5. lego
+
+lego's `exec` provider runs a program to publish and remove the record.
+Jarl ships one, `contrib/lego/jarl-lego.sh`, which calls the `jarl` CLI
+(so jarl must be installed on the same host):
+
+```sh
+sudo install -m 0755 contrib/lego/jarl-lego.sh /usr/local/bin/jarl-lego   # or from /usr/local/share/doc/jarl/contrib/
+export EXEC_PATH=/usr/local/bin/jarl-lego
+export JARL_SERVER=https://ns1.adbraun.lol:8053
+export JARL_TOKEN=@/etc/jarl/certbot.token
+lego --email you@adbraun.lol --dns exec -d adbraun.lol -d '*.adbraun.lol' run
+```
+
+Renew with the same variables and `lego ... renew` in place of `run`.
+
+* lego runs `jarl-lego present FQDN VALUE` and `jarl-lego cleanup FQDN VALUE`,
+  and the script passes them to `jarl acme set|unset --exact`. FQDN is the
+  full record name (`_acme-challenge.adbraun.lol.`), so `--exact` stops
+  jarl from adding `_acme-challenge.` a second time.
+* `JARL_TOKEN` may be the token itself or `@FILE`. `JARL_VIEW` limits the
+  record to one view, and `JARL_BIN` points at jarl if it isn't in `PATH`.
+  When `JARL_SERVER` and `JARL_TOKEN` are unset, jarl's configuration file
+  is used.
+* Leave `EXEC_MODE` unset: the script needs lego's default mode, not `RAW`.
+* lego waits until the record is visible on the zone's name servers
+  (`EXEC_PROPAGATION_TIMEOUT`, 60 seconds by default). Jarl answers only
+  once named serves the record, so this check passes on its first try.
+
+## 6. A dedicated ACME zone (CNAME delegation)
 
 Instead of letting a token write into your main zone, point each challenge
 name at a small zone that exists only for ACME. The token may then write
@@ -112,6 +141,12 @@ target:
 
   The hook passes acme.sh's full record name to `jarl acme --exact`, so both
   modes work.
+* **lego** follows the CNAME itself (unless `LEGO_DISABLE_CNAME_SUPPORT`
+  is set) and passes the target to `jarl-lego`, which writes there with
+  `--exact`. The `acme` role allows only names that start with
+  `_acme-challenge`, so the token needs the grant above, not the role. lego
+  uses the host's resolvers for the lookup; `--dns.resolvers
+  ns1.adbraun.lol:53` asks the Jarl server instead.
 
 A leaked ACME token can then only touch TXT records in the ACME zone, and
 the main zone is never modified by automation.