docs: PR-005 has software rows now, and the rollup should say so

The matrix section still claimed PR-005 "has no software row at all" and could
be verified only by prohibition. jRay's register has carried four rows against
it since the schema-v2 landing: JR-038 (Done), JR-034 and JR-039 (both High,
both T1, both still Planned), and JR-040 (T4). jRay is the component that
actually performs egress, so that is where the goal became verifiable rather
than merely preserved.

Three of the four are untagged in the matrix. That is unbuilt work, not a
broken chain, and saying so here keeps the rollup from reading as an
inconsistency. The structural guarantees still hold PR-005 from the other
side; nothing about SR-004 or GR-005 changes.

jRay/SPEC.md already stated this in the past tense. The vendored copy under
jRay/scripts/vendor/jray-project is a nested checkout of this repo, so it
follows on the next vendor bump rather than needing its own edit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

TRACES: JR-034, JR-039 | PR-005

SPEC.md

@@ -472,9 +472,13 @@ misread as gaps:
 - **`DP-*` and `VR-*` trace to no system requirement.** Deployment and parameter
   studies are single-repo concerns serving `PR-004` and `PR-002` directly. This
   is correct.
-- **`PR-005` (leak nothing) has no software row at all.** It is satisfied
-  *structurally* — `SR-004` (server holds no binary) and `GR-005` (gallery never
-  leaves the instance) — rather than by any component doing something. It cannot
-  be verified by pointing at code, and it dies the moment either prohibition is
-  relaxed. A goal preserved only by prohibitions needs watching precisely because
-  nothing traces to it.
+- **`PR-005` (leak nothing) will look thinly covered, and that is the true
+  picture.** It had no software row anywhere; jRay is the component that
+  actually performs egress, so four rows now carry it — `JR-038` (exchange
+  off by default, Done), `JR-034` (contribution strips `movie` and
+  `jellyfin_id`, posts only to contribute-enabled servers) and `JR-039`
+  (batch `exists` capped at 100, sweeps paced), both High and T1, and
+  `JR-040` (the config page states the per-server exposure, T4). Three are
+  untagged because they are unbuilt, not because the chain is broken. The
+  structural guarantees — `SR-004` and `GR-005` — still hold the goal from
+  the other side, and it still dies the moment either prohibition is relaxed.