Can Syft scan a running container, in case it has changed from the image it started from?

**What happened**: Running syft 'package' , I get a SBOM, but none of the package versions match what is in /var/lib/dpkg/status

**What you expected to happen**: I expect them to match..
Example adduser - syft says 3.134, but status says 3.118

**Steps to reproduce the issue**: Running the binary

**Anything else we need to know?**:

**Environment**:
- Output of `syft version`: 1.18.1
- OS (e.g: `cat /etc/os-release` or similar): Rocky 8

Start by reproducing the reported result with the Syft binary on a running container, comparing package versions against /var/lib/dpkg/status. The work is complete when scanning the running container reflects its current package state rather than only the image it started from.

Written by the indexing model from the issue text.