feat(upgrade): enforce governed artifact verification

[Jagadeeshftw]

Summary

• add a one-time admin-controlled wasm artifact baseline
• require caller-bound expected artifact hashes and contiguous release versions before upgrades
• record auditable upgrade metadata and rely on transaction rollback if the host rejects an artifact
• add focused validation tests and deployment/recovery guidance

Validation

• cargo check --lib
• cargo test --lib test_upgrade (7 passed)
• git diff --check
• 503 changed lines (500 additions, 3 deletions)

Closes #193