docs(platform): verify domain ownership before attaching custom domains

AGENTS.md

@@ -265,7 +265,7 @@ never a diagnostic detour.
 - Deletions: any `... delete` (local or cloud)
 - Local data reset: `volcano reset` (drops all local databases + local platform data; local-only but destructive and not recoverable — confirm first, then re-deploy migrations)
 - Secret / variable changes: `volcano cloud variables deploy`
-- Permission / visibility changes: `volcano cloud functions update --visibility`, `volcano cloud frontends routes`, storage policies, custom domains
+- Permission / visibility changes: `volcano cloud functions update --visibility`, `volcano cloud frontends routes`, storage policies, custom domains, verified domains (`volcano cloud domains verify|remove`)
 - Billing / account changes: plan changes, account promotion
 
 When in doubt, treat the action as confirm-first.
@@ -301,6 +301,7 @@ volcano cloud functions deploy --all
 volcano cloud frontends deploy --name <name> --path <dir> | list | logs
 volcano cloud variables deploy
 volcano cloud config deploy
+volcano cloud domains list | verify <domain> | remove <domain>   # domains your account owns, for custom domains
 ```
 
 > `volcano local ...` and `volcano frontends ...` are deprecated aliases.

volcano-platform/SKILL.md

@@ -583,6 +583,36 @@ rollback step for a failed `config deploy` — neither exists or is needed:
   plan-gated field, etc.) and re-run the same command — don't try to track or
   hand-edit applied state anywhere.
 
+### Custom domains (cloud only)
+
+A frontend serves a custom domain only once the account has verified that
+hostname or a domain above it. Verify once per domain: every name below it is
+then covered, in managed or BYOC TLS, in any of the account's projects. Attach
+the hostname with `volcano cloud frontends domain create` (BYOC) or a manifest
+`frontends[].custom_domain` entry. Verified domains belong to the account, so
+`volcano cloud domains` needs a `volcano login` session; a project access token
+is refused.
+
+```bash
+volcano cloud domains verify example.com   # fails and prints the TXT record to publish
+# the user publishes the printed _volcano.example.com TXT record with their DNS provider
+volcano cloud domains verify example.com   # succeeds once DNS serves the record
+volcano cloud domains list
+```
+
+- Only the user can publish DNS records. Relay the exact record the CLI prints;
+  never invent its value or reuse one from another domain or account.
+- An unverified BYOC attach (`domain create`, or `tls.mode: byoc` in
+  `config deploy`) fails and prints the record to publish. Verify, then re-run
+  the same command.
+- An unverified `tls.mode: managed` entry still deploys: Volcano holds the
+  hostname and `volcano cloud frontends domain get <frontend>` lists the
+  `_volcano` TXT record under "Verification records". Once the record is
+  published, the same command lists the certificate validation CNAME to add.
+- Keep the TXT record published. A domain another account verified stays
+  theirs until their record is gone from DNS. Local mode serves no custom
+  domains, so `volcano domains` refuses.
+
 ## Deploy & Local-Dev Workflow
 
 ### Local development