v0.13.4

Fixed

• Align the packaged Apply contract with hosted contract 3.6.3, including the
  dedicated recovery outcome used after authorization replacement.
• Accept the exact MCP server/discover compatibility probe without widening
  OAuth access, so OpenAI can fall back to the supported legacy protocol and
  complete its required tool scan.
• Lock hosted/local schemas, intentional hosted-only tools, and source/merge
  provenance through the coordinated contract verifier.