Paranoid Merchants on double spending
How can merchant be alerted of any double-spend attacks ?


Running their own daemon will achieve that. 


  Procedures to consider in the time of the attack ? e.g Shutting down servers to avoid confusion and recheck balances to avoid dead ends on user withdrawals


Any backend services run by a merchant need to be able to handle block chain reorganisations anyway! They happen normally, randomly, and without malice. Shutting down is obviously not an option for an event which happens more than once a day. Not handling this behaviour will open the merchant up to rampant theft. 


  How safe is it to run an out of the box Bitcoin Daemon?


Reasonably, the daemon is generally considered to be safe and is written in a language that is normally considered to be safe (C++). However, there have been potential code execution problems due to OpenSSL library and miniupnp. A good node would be at a minimum in a different user account, not not different hardware from production services. 


  Will Bitcoin XT be alerting on any double spend transactions that occurred no matter how the attack succeeded ?


Bitcoin XT is irrelevant. The Bitcoin Core software does not handle alerting you to this, however the best canonical chain changing makes it fairly obvious through the RPC interface. 


  Is it Okay to host a high bandwidth and Intensive website along with a bitcoin daemon?


No. Bitcoin Core is extremely intensive on CPU, IO and memory. It is an extremely harsh test of hardware and will frequently find underlying issues like disk and RAM failure better than any other test- at the cost of your stability. You don't want a vulnerable web server next to something storing money. 


  How Unlikely is it to pull of an attack to a website that credit users on 6 confirmations?


Perhaps unlikely.