Add R-DNS-04, R-DNS-05 and R-SEC-04 to the requirement mirror and tag the L0 tests that verify them. Align the R-ENV and R-UPD-02 summaries with the amended requirements. Point the VPN egress docs at ADR-0020; the drafted "ADR-0016" number went to the Cloudflare Tunnel. Co-Authored-By: Claude Opus 5.5 <[email protected]>