v0.13.3

Adds envpkt diff for comparing two configs.

Added

• envpkt diff <a> <b> compares two configs by their [secret.*]/[env.*] entries —
  keys only in each side plus field-level metadata changes for shared keys. Ignores
  encrypted_value ciphertext (same secret re-encrypts differently) but reports sealed-status
  changes. --format json for scripting; --exit-code exits non-zero on any difference (CI drift
  gate). New library API: diffConfigs. (#22)

Full Changelog: v0.13.2...v0.13.3