@whitequark progress, but still confusion.
Did the additional TXT record as described. Set up the webhook on the repo that's going to be published to the subdomain, as described. My DNS stuff now has two TXT records, one for the domain and one for the subdomain. It also has an A record and an AAAA record with the IPv4 and IPv6 addresses for grebedoc.dev.
It seems to me that the TXT things are for authorization, not to send anyone looking for sub1.swiss-soccer.net to the right place. For that I seem to need a CNAME record. The host is going to be sub1, but for the value I have no idea what to put, except that it seems to be something to do with grebedoc.dev.
(Setting the CNAME value to grebedoc.dev enables me to ping and dig sub1.swiss-soccer.net, but not to access sub1.swiss-soccer.net. When I try, I get This site can’t provide a secure connection: sub1.swiss-soccer.net sent an invalid response.
Can someone help me feel less lost?