feat(contracts): verify bridge-compat ABI shape in CI

[broda-spendy]

Summary

Verifies the bridge-compat ABI shape and event signatures against the vault contract on every upgrade.

• scripts/check_bridge_abi.sh — pure text analysis (no Rust toolchain needed, so it gates even while the workspace does not compile). Extracts every pub fn inside each #[contractimpl] block (normalized signatures) plus all symbol_short! event topics, and diffs the regenerated surface against the snapshot.
• contracts/bridge-compat/abi_snapshot.json — approved surface: 18 bridge functions, 6 event topics, 162 vault entry points.
• New bridge-abi job in rust-wasm.yml (with the script path added to the workflow triggers).

After an intentional change: bash scripts/check_bridge_abi.sh --update.

Design notes

• Extraction targets #[contractimpl] blocks only, ending at the first column-0 }. Brace counting was tried first and abandoned — string literals and comments routinely contain unbalanced braces. Test-only sources (tests/, test.rs, *_tests.rs, fuzz_*, deposit_withdraw_props.rs, benji_strategy.rs) are excluded so test churn never reads as ABI drift; this matters because test.rs and benji_strategy.rs contain their own #[contractimpl] blocks.
• Two bugs found while validating locally and fixed: command substitution strips the trailing newline so while read silently dropped the last alphabetical entry (each list lost one row), and unquoted globs broke on the space in the local checkout path (arrays now).

Validation (MSYS2 bash, login shell)

• bash -n syntax check — clean.
• bash scripts/check_bridge_abi.sh — passes against the committed snapshot.
• --update twice in a row — byte-identical (deterministic).
• Negative test: inserting pub fn fake_drift_probe(env: Env) -> u32 inside the impl block fails the check with a one-line diff naming the function; reverting restores green. A free function appended outside the impl is correctly ignored (not contract ABI).
• Workflow YAML parses (PyYAML).

Not verified: an actual GitHub Actions run (no runner access from here).

Scope notes

• bridge-compat only calls the token client, never the vault directly, so "verified against the vault contract" is implemented as: the vault's full entry-point list is snapshotted alongside the bridge surface, and any vault upgrade that adds, removes, or re-signatures an entry point fails this check until the snapshot is consciously regenerated.
• Overlaps rust-wasm.yml with ci(contracts): type-check every contract crate before merge #1417 (cargo check gate) but in different regions (trigger paths + appended job vs. a step inside rust-test); both should merge cleanly.
• New files are LF; the workflow file keeps its existing CRLF (normalized the appended block).

Closes #1305

[drips-wave]

@broda-spendy Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits