Merge maint into master (outbound admission gate + mesh-size parent skip)

Brings two structural fixes landed on maint:
- compute_mesh_size: explicit parent skip in the children loop, so the
  disjoint-subtree invariant no longer depends on peer_declaration cache
  freshness.
- max_peers: outbound connection-initiation gated on the cap (auto-reconnect
  retries, Nostr-mediated discovery established adoption, and both sides
  of the NAT-traversal punch sequence). Inbound msg1 admission gate
  unchanged.

CHANGELOG.md

@@ -133,6 +133,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Outbound connection initiation now honors the `node.limits.max_peers`
+  cap that was previously only checked on inbound msg1 admission. Four
+  paths gated: auto-reconnect retries (`process_pending_retries`),
+  Nostr-mediated discovery's `BootstrapEvent::Established` adoption, and
+  both sides of the Nostr-mediated NAT-traversal punch (offer initiation
+  in the runtime's outgoing path, offer acceptance in the responder's
+  incoming-offer handler). At saturation, a node now performs zero
+  outbound work on these paths; only existing peer maintenance and
+  overlay-advert refresh continue. The inbound gate at
+  `handshake.rs:1114` is unchanged. Introduces a shared
+  `Node::outbound_admission_check()` helper so the invariant is
+  grep-able and unit-testable.
+- Mesh-size estimator (`compute_mesh_size`) no longer double-counts the
+  parent's bloom cardinality during the transient cache window after a
+  local parent-switch. Symptom: `fipsctl show status` / fipstop displayed
+  mesh size nearly-but-not-exactly doubling during tree rebalancing.
+  Fix: explicit parent-skip at the head of the children loop, making the
+  disjoint-subtree invariant structural rather than dependent on
+  `peer_declaration` cache freshness. Per-peer 500 ms rate-limiter and
+  overall recompute cadence are unchanged.
 - Spanning-tree state distribution is now eventually-consistent.
   Previously every `send_tree_announce_to_all` call site fired only
   on a local state-change event (parent switch, self-root promotion,