v0.13.4

Payload capture now passes --no-upgrade when downloading resident packages and installing the full capture seed. This avoids requesting upgrades for seed packages already supplied by the provider base. The existing resident startup install and archive integrity checks keep their current behavior.

A native package-only probe captured 54 resident debs and classified the declared 102-package closure with no base-version changes. The resident records matched the 54 debs previously applied in the diagnostic. A new full capture and admission remain required for the changed source fingerprint; existing archives must retain their original identities.

Independent source review and Linux and macOS CI passed. Whole cold-start performance with the new payload remains unmeasured.