Amend ADR-0013: VPN protocol WireGuard -> OpenVPN-UDP (Gluetun lacks PIA+WG)

Gluetun does not support Private Internet Access over WireGuard (upstream:
native support "cannot be added... slow work in progress"; confirmed live
rejecting the provider on v3.40/v3.41/latest). PIA in Gluetun is OpenVPN-only.

Amend ADR-0013 to PIA over OpenVPN-UDP. The egress ARCHITECTURE is unchanged
(single shared gateway, central kill-switch/fail-closed, native PF, Cilium
egress steering, active/standby) and R-NET-05/06/07 remain met; only the tunnel
protocol changes. OpenVPN-UDP satisfies "non-TCP", and Gluetun's HTTP control
API (health + forwarded-port lookup) is what the shared-gateway topology needs.
thrnz/docker-wireguard-pia retained as a documented WireGuard fallback.

Propagated the protocol correction to all active specs: ADR-0013 (+amendment
note), decisions/README, docs/00, docs/01, docs/03, docs/07, agents/task-board.
Superseded ADR-0008/0012 left immutable as historical record.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

docs/07-security-and-secrets.md

@@ -47,7 +47,7 @@ Defense in depth with declarative, auditable controls:
   [AGENTS.md §5](../AGENTS.md)).
 
 ### Secret categories to manage
-- VPN credentials (PIA username/password; WireGuard) for the egress model (ADR-0013).
+- VPN credentials (PIA username/password; OpenVPN-UDP) for the egress model (ADR-0013).
 - Keycloak admin credential and per-service **OIDC client secrets** ([15](15-identity-and-access.md)).
 - DNS provider API token (Cloudflare) for ACME DNS-01 + ExternalDNS.
 - SMTP credentials for Alertmanager email.