`deploy.yml`/`deploy-testnet.yml` — confirm the deployment pipeline verifies the deployed WASM hash matches what was actually reviewed/merged, not just "whatever `cargo build` produces at deploy time"

[Christopherdominic]

For a contract handling real user funds, the gap between "the WASM hash a security reviewer looked at (or that CI's security.yml scanned)" and "the WASM hash that actually gets deployed" is a meaningful supply-chain concern — a non-reproducible build (even innocently, from a different Rust/soroban-sdk toolchain version between review-time CI and deploy-time CI) could produce a different WASM hash than what was reviewed, and nothing about "the code in the PR looked fine" guarantees the deployed artifact matches it unless the build is genuinely reproducible and the pipeline explicitly checks the hash.

Task: Confirm the contract build is reproducible (pinned toolchain via rust-toolchain.toml, Cargo.lock committed and honored, no --release non-determinism from parallel codegen given codegen-units = 1 is already set which helps), and add an explicit step to deploy.yml/deploy-testnet.yml that computes and logs (or better, asserts against a value recorded at PR-merge time) the WASM hash being deployed, so there's an auditable record that what got deployed is what got reviewed.

[Hollujay]

Kindly assign the issues to me, I will surely get them done @Christopherdominic