Merge branch 'master' into next

Forward-merge the v0.4.0 pre-release content (dependency refresh, CI
deb-install + AUR-build legs, docs refresh, doc-comment fixes, and the
Phase 4 source-content squash: CHANGELOG, release notes, README,
fips.yaml, Cargo.toml metadata, reference docs) up the one-way flow.

Conflict fixups (keep next's identity, fold in master's improvements):
- Version: keep next's 0.5.0-dev (Cargo.toml/lock).
- README status: keep next's v0.5.0-dev / wire-format-breaking framing
  and the Breaking-section pointer; fold in the Nym transport and the
  "global, public test mesh of thousands of nodes" description.
- docs/reference/cli-fips.md: keep next's 0.5.0-dev version example.
- CHANGELOG: keep next's XX-handshake admission entry (no early cap gate
  on XX) and drop master's IK early-cap-at-handle_msg1 entry, which
  describes IK-only behavior that does not apply on next; take master's
  OR-union mesh-size rewrite (next carries the OR-union code); restore
  the Tor connect_refused and MMP receiver-report entries that the
  Fixed-section consolidation would otherwise have dropped.
- lifecycle.rs: keep the mDNS/LAN handshake doc-comment as Noise XX
  (next unifies on XX), not master's XX-to-IK correction.

Quartet green on the merged tree: fmt, build, clippy -D warnings, and
cargo test --lib (1434 passed).

src/node/mod.rs

@@ -1347,9 +1347,12 @@ impl Node {
 
     /// Compute and cache the estimated mesh size from bloom filters.
     ///
-    /// Uses the spanning tree partition: parent's filter covers nodes reachable
-    /// upward, children's filters cover disjoint subtrees downward. The sum
-    /// of estimated entry counts plus one (self) approximates total network size.
+    /// Builds an OR-union of self plus every connected peer's inbound filter
+    /// and estimates its cardinality once. Unioning (rather than summing
+    /// per-peer counts) deduplicates the overlap between the split-horizon
+    /// filters, each of which approximates "the whole mesh minus my subtree".
+    /// See the body for why all routing peers contribute, not just the tree
+    /// neighborhood.
     pub(crate) fn compute_mesh_size(&mut self) {
         let my_addr = *self.tree_state.my_node_addr();