docs: pin toolchain and document reproducible builds for deployed contracts

[Fabluchy]

Summary

Closes #59 — makes the deployed testnet contract WASM independently verifiable against published source, and honestly documents how far that verification currently goes.

What changed

• rust-toolchain.toml — pins rustc 1.95.0 (+ the wasm32v1-none target) so rustup auto-selects the exact toolchain for anyone building this repo. CI's dtolnay/rust-toolchain steps pick this up automatically (no explicit toolchain input is set).
• Cargo.toml — soroban-sdk pinned exactly (=26.1.0) instead of a caret range; decision recorded in the README (issue No reproducible-build / supply-chain verification — deployed testnet WASM hash cannot be independently confirmed against published source #59 asks for this to be considered).
• README.md —
  • deployed-contracts table now includes the actual on-chain WASM SHA-256 for all three contracts, read directly from the testnet ledger (not computed from source);
  • new "Reproducible builds" section: the full verify recipe, the never run cargo update before a build you intend to deploy rule, the soroban-sdk pinning decision, and the honest state of the currently-deployed bytecode (see below).
• scripts/verify-wasm-hash.mjs + make verify — compare locally built .wasm against the ledger-recorded hash for each deployed contract; exits non-zero on mismatch.
• contracts/escrow/src/test.rs — fixed a pre-existing failing test (test_multi_sponsor_refund_returns_exact_contributions_to_each_sponsor): it set the ledger timestamp inside the deadline + GRACE_PERIOD window, so the permissionless-refund path never opened and the call failed auth. Was failing on main (29/30 escrow tests) and would have kept CI red.

What the verification found (important, documented in the README)

Forensics on the deployed WASM (embedded contractmetav0 metadata records rsver = 1.95.0, and panic-location strings embed /Users/user/.cargo/... registry paths) show the deployed contracts were built from commit 8a7efbf (2026-07-05) with rustc 1.95.0 on macOS:

1. Current main does not produce the deployed hashes — the deployed contracts predate the multi-sponsor crowdfunding, mergefi-common extraction, and milestones-crowdfunding changes. make verify on main reports a mismatch by design until the contracts are redeployed.
2. Even at commit 8a7efbf with rustc 1.95.0, a Linux build is ~99% byte-identical but not hash-identical to the deployed macOS build (16 of 184 functions differ by 1–2 bytes plus function-ordering; sizes and metadata match exactly) — because soroban-sdk panic locations embed the build machine's absolute CARGO_HOME path and LLVM/LTO codegen is host-dependent. This is precisely the supply-chain limitation the issue is about, and it's now documented with the exact hashes so a reader can see it rather than trust it.

The ledger-recorded hashes (published in the README) are the ground truth via make verify.

Verification

• cargo test --workspace — 56/56 pass (30 escrow, 19 milestones, 7 maintenance-pool)
• cargo clippy --workspace --all-targets -- -D warnings — clean
• cargo fmt --check — clean
• make build (wasm32v1-none, rustc 1.95.0) — succeeds; make verify correctly reports mismatch vs. the pre-crowdfunding deployed bytecode (documented)

closes #59

[vercel]

@Fabluchy is attempting to deploy a commit to the chonilius' projects Team on Vercel.

A member of the Team first needs to authorize it.