docs: refresh README, CONTRIBUTING, and examples for v0.3.0

Four short prose corrections folded together to align operator-facing
docs with current v0.3.0 reality:

- README Rust prerequisite reconciled with the toolchain pin (1.94.1,
  was 1.85+).
- CONTRIBUTING.md bumps the Rust prerequisite and adds the squash-merge
  policy note.
- examples/sidecar-nostr-relay/Dockerfile drops stale --features tui
  and the paired --no-default-features; the tui/ble/gateway cargo
  features were replaced by platform cfg gates in cbc7809.
- README Features list adds two v0.3.0-visible items: the mesh-
  interface security baseline (fips.nft conffile, fips.d/ drop-in,
  opt-in fips-firewall.service across all packaging formats) and the
  fipsctl stats time-series queries plus fipstop inline sparkline
  dashboards.

Status badge bump (v0.3.0--dev to v0.3.0) is deferred to tag time per
the release-prep checklist.

CONTRIBUTING.md

@@ -17,7 +17,7 @@ Before changing code, read the protocol docs in this order:
 
 ## Prerequisites
 
-- Rust 1.94.0 and Linux with TUN support
+- Rust 1.94.1 and Linux with TUN support
 - Use the pinned toolchain from [rust-toolchain.toml](rust-toolchain.toml) for deterministic builds
 - For the default BLE-enabled build on Debian/Ubuntu:
   `sudo apt install bluez libdbus-1-dev pkg-config`
@@ -74,6 +74,7 @@ See [testing/README.md](testing/README.md) for the available integration and cha
 - Keep commits focused — one logical change per commit.
 - Add tests for new functionality.
 - Reference relevant design docs if the change touches protocol behavior.
+- Pull requests are merged via squash-merge.
 - Update docs in the same change when you modify:
   - protocol or routing behavior
   - wire formats

README.md

@@ -66,9 +66,17 @@ same way it would on a local network.
   Protocol.
 - **ECN congestion signaling.** Hop-by-hop CE-flag relay with RFC
   3168 IPv6 marking and transport kernel-drop detection.
-- **Operator visibility.** `fipsctl` CLI for control and inspection,
+- **Mesh-interface security baseline.** Optional default-deny
-  `fipstop` TUI for live status, and a JSON-line control socket on
+  nftables policy for `fips0` shipped as a packaged conffile
-  each binary for direct programmatic access.
+  (`/etc/fips/fips.nft`) with an operator drop-in directory
+  (`/etc/fips/fips.d/`) and a disabled-by-default
+  `fips-firewall.service`. The baseline polices only the mesh
+  interface, leaving Docker, Tor, and the host firewall untouched.
+- **Operator visibility.** `fipsctl` CLI for control and inspection
+  with time-series stats history queryable for any metric,
+  `fipstop` TUI for live status with inline sparkline dashboards,
+  and a JSON-line control socket on each binary for direct
+  programmatic access.
 - **Reproducible builds** with toolchain pinning and
   `SOURCE_DATE_EPOCH`.
 
@@ -103,7 +111,7 @@ tutorial progression starting at
 cargo build --release
 ```
 
-Requires Rust 1.85+ (edition 2024). Linux, macOS, and Windows are
+Requires Rust 1.94.1+ (edition 2024). Linux, macOS, and Windows are
 supported; transport availability varies by platform.
 
 | Transport | Linux | macOS | Windows | OpenWrt |

examples/sidecar-nostr-relay/Dockerfile

@@ -10,7 +10,7 @@ WORKDIR /build
 COPY Cargo.toml Cargo.lock rust-toolchain.toml build.rs ./
 COPY src ./src
 
-RUN cargo build --release --no-default-features --features tui && \
+RUN cargo build --release && \
     cp target/release/fips target/release/fipsctl target/release/fipstop /usr/local/bin/
 
 # ── Runtime stage ──