feat(contrib): add TXT record helper with key generation

- Add contrib/make_welist_txt.sh to print the _welist-key TXT
  name, value and BIND zone line for a domain and Ed25519 key
- Accept a private/public PEM file or an existing base64 SPKI DER
- Generate private_key.pem and public_key.pem when the key argument
  is omitted, reusing an existing private key
- Document the helper in docs/10_dnssec_key_publishing.md

docs/10_dnssec_key_publishing.md

@@ -71,6 +71,13 @@ openssl pkey -in private_key.pem -pubout -out public_key.pem
 chmod 600 private_key.pem
 ```
 
+Alternatively, `contrib/make_welist_txt.sh <host>` generates
+`private_key.pem` and `public_key.pem` in the current directory when the key
+argument is omitted, then prints the TXT record. The private key is created at
+mode `0600`. If `./private_key.pem` already exists, the script reuses it instead
+of overwriting it. Move both files to a protected location before starting the
+services.
+
 Then point both settings at the new pair and restart `bal-server` and
 `bal-pusher`:
 
@@ -100,6 +107,10 @@ KEY=$(openssl pkey -in private_key.pem -pubout -outform DER | base64 | tr -d '\n
 echo "v=we1; alg=ed25519; key=$KEY"
 ```
 
+`contrib/make_welist_txt.sh <host> [key]` prints the record name, value, and a
+BIND zone line directly. `key` may be a private/public PEM file or an existing
+base64 SPKI DER value; omit it to generate a new key pair first.
+
 The value has this form:
 
 ```text