Docs: lego 5, and split DNS with lego's propagation check

docs/acme.md and jarl-lego show lego 5's commands (lego run, which also
renews; lego migrate when upgrading) beside lego 4's. A new section
explains why lego on a host inside a split DNS fails its own propagation
check when the challenge goes into the external view only (JARL_VIEW, a
one-view token, httpreq's /view/...), and the ways round it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,17 @@ All notable changes to Jarl are documented here. The format follows
 
 ## [Unreleased]
 
+### Added
+
+- A docs/acme.md section: lego on a host inside a split DNS fails its own
+  propagation check when the challenge is written into the external view
+  only (`JARL_VIEW`, a one-view token, `.../httpreq/view/...`): why, and
+  the ways round it (no view limit, `--dns.propagation.disable-ans` or
+  `--dns.propagation.wait`, Traefik's `propagation.disableANSChecks`).
+- docs/acme.md and `jarl-lego` show lego 5's commands (`lego run ...`,
+  which also renews; `lego migrate` when upgrading), with lego 4's
+  beside them. Jarl's side is the same for both.
+
 ## [0.6.2] - 2026-10-21
 
 ### Added