Add read-only VPN connection status

[MarcLeinenDE]

Adds a deliberately minimal client.vpn namespace with only the upstream live-verified normal-admin connection-status read.

Scope:

• client.vpn.status() → cm/get_vpn_client_connect_status
• typed raw response: result, vpn_status
• exact GET routing locked down by offline tests
• dedicated read-only physical smoke

Safety/privacy:

• does NOT call cm/get_vpn_clients, whose response may contain VPN passwords/PSKs
• no VPN profile read, add/edit/delete/activate/connect/disconnect action
• no configuration write or connectivity transition
• raw future vpn_status values are preserved rather than normalized

Physical ACIY.3 evidence (2026-09-08):

• targeted test_vpn_status_read passed 1/1 in 0.44 s on Python 3.13.5
• only cm/get_vpn_client_connect_status was exercised
• no VPN profile/credential-bearing response was requested and no VPN state was changed

Documentation:

• README exposes client.vpn.status() and explains why profile reads stay outside this routine surface
• CHANGELOG records helper and physical validation
• docs/vpn-status-read.md records scope, privacy and evidence
• no nr2301-api change is needed because this run introduced no new wire semantics; the getter was already upstream LIVE_VERIFIED, ADMIN_OK, READ_OR_LOW_SIDE_EFFECT

Validation:

• initial PR CI run #233: Python 3.10/3.11/3.12/3.13 and package all SUCCESS
• final PR diff reviewed; only intended SDK/helper/test/documentation changes remain