Are your sys-firewall and sys-net VMs running?
When you run qubes-dom0-update, it sends commands to the firewall via qrexec to allow dom0 outbound to the update servers.
Yes. I have both sys-net and sys-firewall running.
QWT hasn't been built for r4.0 yet, so you can't install it yet.