Activate dual genesis keys

## Why

The dual genesis key (legacy Ed25519 paired with a SNARK-friendly Schnorr key) is implemented, but no network publishes one. Without it, no network can run the `lagrange` era, whose genesis ceremony produces and verifies both signatures. The dual bundle cannot replace the published `genesis.vkey`, as its layout is not readable by the released clients: it must be published at a new URL, next to the existing one.

## What

Run the dual key ceremony for every network and publish the resulting verification key as `genesis-dual.vkey`, keeping `genesis.vkey` available for the clients which only support Ed25519.

## How

- [ ] Create the dual signing bundle from the existing genesis secret key with `genesis upgrade-key-to-dual`, and secure the Schnorr half as the Ed25519 one
- [ ] Generate and publish `genesis-dual.vkey` at the new URL:
- [ ] `testing-preview`
- [ ] `pre-release-preview`
- [ ] `release-preprod`
- [ ] `release-mainnet`
- [ ] Expose the new key next to the existing one in `networks.json`, the networks matrix, and the infrastructure variables
- [ ] Define and document when a node or a client must use each of the two keys
- [ ] Create a dev blog post explaining the transition to dual genesis