docs: add design spec and implementation plan for dual-publish

[armcconnell]

Spec-only PR. No behavior change, no workflow change, nothing published to the live site.

Design doc: .specs/2026-08-10-docs-dual-publish-design.md

Summary

• Documents how to serve the docs at docs.doublezero.xyz (new canonical home, Vercel) while docs.malbeclabs.com keeps working on GitHub Pages exactly as it does today.
• GitHub Pages matches a single custom domain against the incoming Host header, so a second hostname needs a second origin, not another DNS record. Pointing a new CNAME at malbeclabs.github.io returns 404.
• Adding Vercel as a real second origin is the only option requiring no cutover, so the existing hostname has zero downtime.
• Both origins deploy the same prebuilt site/ artifact from one mkdocs build, which removes the drift risk that normally argues against two origins.
• site_url moves to docs.doublezero.xyz so canonical tags, sitemap.xml, llms.txt, and the .well-known discovery files all consolidate on the future hostname, even on pages served from the legacy one.
• Records the fork-PR constraint: this repo is public and takes fork PRs, which cannot receive secrets. Preview deploys are gated to same-repo PRs, and pull_request_target is rejected with the reasoning written down so it isn't reintroduced later.
• Retiring docs.malbeclabs.com later becomes a DNS change plus deleting one workflow job, with no content churn.

Lifetime

Temporary, to be deleted once the change ships. Placed in .specs/ rather than docs/ specifically so it is never published to the public docs site.

Testing Verification

• Confirmed mkdocs.yml sets no explicit docs_dir, so it defaults to docs/ and .specs/ sits outside the published tree. The spec cannot reach the live site.
• Confirmed the diff is exactly one file. An unrelated untracked spec in .specs/ was deliberately not included.
• DNS claims in the spec verified with dig: malbeclabs.com and doublezero.xyz are both on Cloudflare nameservers, docs.malbeclabs.com is a DNS-only CNAME to malbeclabs.github.io resolving to GitHub's 185.199.x addresses, and docs.doublezero.xyz does not yet exist.
• Fork-PR constraint verified against real history rather than assumed: repo visibility is PUBLIC, and PRs Docs update data doublezero urls + small typo fixes #192 and docs: fix withdrawal instructions for clarity #189 came from the Jotatavo fork.
• The hostname reference table (file plus line number) was built by grepping the tree, not from memory, and excludes the stale committed site/ build output.