Warn on deploy when sources changed without a version bump

[charlesHetterich]

What

cdm deploy is idempotent by version: a crate whose Cargo.toml version is at or below the registry's latest is skipped as up-to-date. That silently masks the edit-the-code-forget-to-bump mistake. This PR closes that gap:

• Publish side — each publish now includes a source_hash in its metadata (beside storage_layout): a deterministic blake2b-256 digest over the contract's source inputs. Rust crates hash Cargo.toml + everything under src/ recursively; Solidity targets hash the source file plus its relatively-imported local .sol files (reusing the existing import traversal; remapped/library imports are not followed). Files are sorted by root-relative path and each contributes blake2b(relpath \0 content) to the running digest, so write order never matters while renames and edits both change the hash.
• Deploy side — when a contract resolves to up-to-date, the pipeline recomputes the local hash and fetches the latest published metadata through the (new, optional) injected IPFS gateway. On mismatch it emits a new advisory check-source-drift event; the CLI renders the row's marker as a yellow up-to-date! plus a warning line: @org/foo 1.0.0 is up-to-date on-chain but local sources differ — did you forget to bump the version?

Why a source hash, not a bytecode hash

PolkaVM output is sensitive to the rustc / cargo-pvm-contract / SDK-revision combination — identical sources produce different blobs across toolchains, and heterogeneous toolchains across a team are the expected state. A bytecode comparison would fire on every toolchain skew and train people to ignore it. Hashing the source inputs is toolchain-independent by construction.

Never fatal, never noisy

The check is advisory only. A hash match, a publish that predates source_hash, a missing/unreachable gateway, an older registry generation, or unreadable local sources all resolve to exactly today's behavior — a silent up-to-date skip. Nothing on this path can fail or slow a deploy beyond the metadata fetch, and no status ever changes.

Tests

• Hash-helper unit tests: write-order independence, content-change and rename sensitivity, crate-move stability, Solidity relative-import traversal.
• Pipeline tests: source_hash lands in the published metadata; the warn path emits check-source-drift right after check-up-to-date with the differing pair; the silent paths (match / absent hash / gateway failure) emit nothing and stay non-fatal.

Closes #82