Add: dns leak detection

docs/status.md

@@ -29,6 +29,11 @@ This document tracks the planned roadmap alongside the current implementation st
 - optional LLMNR/NBNS discovery
 - optional HTTP/3 (feature-gated; experimental, incomplete)
 
+### v0.4 (dns leak detection)
+- dns leak detector (passive watch + report)
+- process attribution (best-effort)
+- policy profiles + privacy modes
+
 ## Current stage
 
 ### Implemented
@@ -69,13 +74,20 @@ This document tracks the planned roadmap alongside the current implementation st
 - v0.3: TLS extras (OCSP flag + richer cert parsing).
 - v0.3: cert baseline/diff improvements.
 - v0.3: HTTP/3 request path (feature-gated; experimental, incomplete).
+- v0.3: HTTP/3 error classification (feature-gated).
+- v0.4: platform flow-owner lookup (best-effort).
+- v0.4: dns leak detector crate + CLI commands (status/watch/report).
 - Discover crate with mdns/ssdp commands.
+- Discover llmnr/nbns (best-effort).
 - Diag crate with report and bundle export.
 - Basic unit tests for calc and TLS parsing.
 
 ### In progress
+- v0.4: DoH heuristic classification (optional).
+- v0.4: Leak-D mismatch correlation (optional).
 - v0.3: optional HTTP/3 (feature-gated; keep disabled until stabilized).
 
 ### Next
-- Complete v0.3 trace upgrades and update CLI output.
+- Update docs/README/COMMANDS for v0.4.
 - Add v0.2 tests (dns detect, basic http/tls smoke).
+- Track DNS leak design status in `docs/dns_leak_implementation_status.md`.