fix: address PR #32 review comments

[rubydusa]

Summary

Addresses review comments from @rubydusa on PR #32.

• Remove run-upgrade-safety input — upgrade safety always runs; removes the issue where disabling it implicitly blocked testnet deployment
• Simplify Node.js cache setup — cache: ${{ inputs.package-manager }} instead of ternary expression; setup-node ignores invalid cache values
• prepare-env.sh fails on malformed lines — lines without = or with invalid key names now error instead of being silently skipped
• Extract config validation to validate-config.sh — checks that no .contract entries were removed compared to the base branch (subset check by contract name, not just count)
• Simplify validate.sh — empty contracts array is a simple skip; complex base-branch comparison logic moved to the dedicated config validation script; removed ALLOW_FALLBACK
• Hard fail on base branch errors — when contracts without explicit references exist, fetch/checkout/build failures are errors, not warnings

Test plan

• shellcheck passes on all scripts
• All unit tests pass (bash tests/test-*.sh)
• Verify upgrade-safety runs unconditionally (no run-upgrade-safety toggle)
• Verify validate-config.sh catches removed contracts
• Verify prepare-env.sh fails on malformed DEPLOY_ENV_VARS

🤖 Generated with Claude Code