Add stellar contract verify command

[fnando]

⚠️ Depends on #2585 — do not merge until #2585 lands on main. This PR's base is contract-build-verifiable, so once #2585 merges, GitHub will automatically retarget this one to main.

What

Adds a new stellar contract verify subcommand that takes a contract id (--id, fetched from the network) or a local WASM (--wasm), reads the SEP-58 build metadata embedded in it (bldimg, source identification, build flags), re-runs the recorded build inside the recorded container image, and byte-compares the result against the original to confirm the WASM is reproducible.

Notable bits:

• Source materialization works for both git pairs (source_repo + source_rev) and tarballs (tarball_url + tarball_sha256). For WASMs that record only tarball_sha256, the user can supply a local file or URL via --tarball-url.
• Git cloning uses gix (with rustls TLS) instead of shelling out to git, so the command has no runtime dependency on a system git binary and there's a single retrieval channel to gate on.
• A trust prompt fires before pulling an unrecognized bldimg, and unconditionally for any tarball source (tarballs are never default-trusted). --trust skips it; the prompt overrides --quiet so it can't be silenced by accident. The default trust list is the stellar/stellar-cli image.
• The materialized source directory is created with hardened permissions so a local attacker can't slip a file in mid-verify.
• Integration tests cover the git source path, tarball-by-URL, tarball-by-local-file (with --tarball-sha256), and the trust-prompt flow; they live in the existing integration tier.

Why

#2585 makes it possible to produce a verifiable build; this PR is the other half — a way to check a deployed contract against its claimed source. Together they close the SEP-58 loop end-to-end in the CLI.

Known limitations

N/A

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​reqwest@​0.13.3
	cargo/​gix@​0.83.0
	cargo/​tar@​0.4.46
	cargo/​tempfile@​3.21.0 ⏵ 3.27.0	-1

View full report