[chen21019]

Scope

• Prepare Node Agent 0.13.30 with official checksum-pinned Go 1.27.3; retain Go language level and dependency graph.
• Apply only actual blocking official Ubuntu fixes: curl 8.18.0-1ubuntu2.8, OpenSSL 3.5.5-1ubuntu3.7, and linux-libc-dev 7.0.0-38.38. Preserve signed snapshot/TLS and runtime builder backend.
• Refresh only the existing builder-only no-kernel header exact CVE/PURL/version metadata to the actual 295 unfixed set, with the existing status/justification/code-absence policy unchanged. No new waiver or runtime exception.
• Bind the unchanged strict Host API equality guard to official 0.38.6; retain rejection of 0.38.5, malformed versions, unsafe executables and fallback.
• Ignore generated /evidence/ only; align complete Git history/tags; require clean exact producer buildinfo for Linux and Windows. Retain the exact Security-run scanned archives/checksum for publication.

Verification

• 14 focused source/negative controls pass locally without an SDK, image, VM or product execution.
• Original complete CI, deterministic packaging, runtime --version, Linux binary reproducibility, product rootfs gobinary, source/runtime/builder security gates and all required CodeQL checks remain required.
• Earlier same-source cross-run byte differences were caught before publication. No tag or release was created from those candidates. The release will use only the final successful Security run's original package bytes, not substitute Validate-run archives.
• Windows qualification is cross-build/package metadata only, not new Windows runtime acceptance.
• No Server changes or deployment. No protection bypass, scanner threshold change, business-logic refactor, dependency update or policy change.