test: maximize FuSa/cyber requirement test coverage to 100%

[SoundMatt]

Summary

Raises requirement→test traceability from 51% (166/322) to 100% (331/331), across both functional-safety (ISO 26262) and cybersecurity (IEC 62443 / mTLS / E2E) requirements.

Changes

• Declared 9 missing requirements (REQ-CLI-001..004, REQ-RELAY-001..005) in .fusa-reqs.json — they were exercised by tests but absent from the DB. Fixed test_cli/test_relay to use the fusa:test tag (they used fusa:req, which made them invisible to the coverage scan).
• Bucket A (12 existing files): completed fusa:test headers and added real cases for previously-untested requirements — thread-safety (admin/authz/dyndata/observe/record), span error + counter capture (observe), ErrClosed/ErrTimeout failover (redundancy), latency-budget timeout & deregister-closes-upstream (proxy), multi-chunk firmware transfer, federation close/closed-lookup/dup-register, config ParseError, zonegroup value-semantics & context-deadline.
• Bucket B (13 new files): canbr, ddsbr, doipbr, grpcbridge, linbr, mqttbr, restbridge, someipbr, udsbr, tsn, mdns, powerstate, tls — wired into CTest. Stub/TLS tests assert the observable surface (function_not_supported, config defaults, secure-by-default refusal rather than plaintext fallback), with comments noting the link-gated real backends.

Verification

• 331/331 requirements test-traced (314 ISO 26262 + 8 IEC 62443 + 9 RELAY/CLI conformance).
• 41 ctest suites, 323 TEST_CASEs, all green locally. (rcp_latency is a pre-existing timing flake under parallel load; passes in isolation and CI runs serially.)
• All cybersecurity controls (AUTH, TLS, E2E, CAPI) covered.

Note: TARA.md working-tree change is the parked case-collision item and is intentionally excluded from this PR.