tobi--.zst carrier slices are produced by the flake.nix preBuild hook or scripts/build-universal.sh. this file is tracked so //go:embed payloads/* matches on a clean checkout; it is never read at runtime.