v0.13.4

Fix opt-in mTLS execution and certificate rotation through SDK-core 0.3.3. Execution checkpoints use the certificate-assigned worker ID; pull workers and retained engine clients reconnect after certificate renewal. Discovery authority is scoped to each connection. Bearer authentication remains the default.

No language-level public API changes.