Include after_unknown keys in the version-only diff so a computed-only allowlist cannot hide an unexamined environment mutation.