Verify whether newer-SDK/older-executor version skew occurs (justifies permissive experimental block)

Nobody has claimed this yet.

### Description of the task

Determine whether any real deployment scenario exists today in which a **newer mxc SDK** (npm `@microsoft/mxc-sdk` or the C# `Microsoft.Mxc.Sdk`) emits configuration that an **older `wxc-exec` / `mxc-exec` executor** binary must parse.

This "version skew" is currently the sole justification for keeping the `experimental` block in the wire model (`src/core/wxc_common/src/wire.rs`) **permissive** (no `deny_unknown_fields`), so that an older executor silently tolerates unknown additive fields emitted by a newer client rather than rejecting the whole config.

If no such skew actually occurs (the SDK and native binaries are co-packaged / co-versioned), we should consider flipping `experimental` to `deny_unknown_fields` **globally** — making it fail-closed on typos and unknown fields, matching the stable surface — instead of only selectively restricting it on the security-sensitive `tamperProtection` section.

Concretely, answer:

- Are the SDK packages and the native executor binaries ever distributed/updated independently, or always together (build.bat/build.sh copy binaries into `sdk/*/bin`)?
- Do any supported hosts pin an older executor while accepting configs from a newer SDK?
- Given the answer, recommend **global** vs **selective** `deny_unknown_fields` for `experimental`.

### Additional context

- Context: the immediate `tamperProtection` work will selectively restrict only its own structs with `deny_unknown_fields` (fail-closed on misspelled protection flags) rather than flipping the whole `experimental` subtree, to avoid imposing version-lockstep on other in-flux backends.
- Relevant code: `src/core/wxc_common/src/wire.rs` (the permissive `Experimental` struct and its comment explaining the "in flux" rationale); the stable structs all carry `deny_unknown_fields`.
- Note that `deny_unknown_fields` is **not recursive** — a global flip requires it on every nested experimental struct, and must cover both deserialization sites (one-shot typed `Experimental` and the state-aware raw→per-backend re-typing in `config_parser.rs`).