Deterministic, policy-free execution-surface diffing.
M4 reports evidence. It intentionally assigns no security severity and no PASS / REVIEW / BLOCK verdict.