Merge branch 'master' into next

Forward-merge the v0.4.0 pre-release content (dependency refresh, CI
deb-install + AUR-build legs, docs refresh, doc-comment fixes, and the
Phase 4 source-content squash: CHANGELOG, release notes, README,
fips.yaml, Cargo.toml metadata, reference docs) up the one-way flow.

Conflict fixups (keep next's identity, fold in master's improvements):
- Version: keep next's 0.5.0-dev (Cargo.toml/lock).
- README status: keep next's v0.5.0-dev / wire-format-breaking framing
  and the Breaking-section pointer; fold in the Nym transport and the
  "global, public test mesh of thousands of nodes" description.
- docs/reference/cli-fips.md: keep next's 0.5.0-dev version example.
- CHANGELOG: keep next's XX-handshake admission entry (no early cap gate
  on XX) and drop master's IK early-cap-at-handle_msg1 entry, which
  describes IK-only behavior that does not apply on next; take master's
  OR-union mesh-size rewrite (next carries the OR-union code); restore
  the Tor connect_refused and MMP receiver-report entries that the
  Fixed-section consolidation would otherwise have dropped.
- lifecycle.rs: keep the mDNS/LAN handshake doc-comment as Noise XX
  (next unifies on XX), not master's XX-to-IK correction.

Quartet green on the merged tree: fmt, build, clippy -D warnings, and
cargo test --lib (1434 passed).

testing/check-ci-parity.sh

@@ -13,9 +13,9 @@
 #
 # Granularity-only differences folded before comparison (same coverage,
 # different matrix shape — NOT a divergence):
-#   deb-install    — GitHub splits into per-distro legs
-#                    (deb-install-debian12/ubuntu24/ubuntu26); local runs all
-#                    distros in one suite. Folded to "deb-install".
+#   deb-install    — GitHub splits into per-distro legs (deb-install-debian12/
+#                    debian13/ubuntu22/ubuntu24/ubuntu26); local runs the same
+#                    distro set in one suite. Folded to "deb-install".
 #   chaos-*        — GitHub fans each chaos scenario into its own matrix leg
 #                    (type: chaos); local runs them all via the one CHAOS_SUITES
 #                    path. The individual scenario names also differ cosmetically

testing/ci-local.sh

@@ -50,7 +50,8 @@
 # Granularity-only differences (same coverage, different matrix shape —
 # NOT a divergence):
 #   deb-install    — local runs all distros sequentially in one suite; GitHub
-#                    splits into per-distro legs (debian12/ubuntu24/ubuntu26).
+#                    splits into per-distro legs (debian12/debian13/ubuntu22/
+#                    ubuntu24/ubuntu26 — the same distro set).
 #   dns-resolver   — single suite both sides; runs all scenarios.
 # ─────────────────────────────────────────────────────────────────────────────
 set -uo pipefail