Warn on deploy when sources changed but the version wasn't bumped (source hash, not bytecode hash)

Problem

cdm deploy is idempotent by version: a crate whose Cargo.toml version is at or below the registry's latest key is skipped as up-to-date. That's the right npm-like contract, but it makes one mistake silent: edit the code, forget to bump, deploy — and the stale version stays live with only a (correct-looking) up-to-date row to show for it.

Why NOT bytecode comparison

The obvious check — hash the freshly built blob against the published implementation's on-chain code — false-positives constantly: PolkaVM output is sensitive to the rustc / cargo-pvm-contract / SDK-revision combination (observed directly: identical source produced different blob bytes across sdk dc2c857 → 4a4ad114, and the repo's policy is to float on latest, so heterogeneous toolchains across a team are the expected state). A warning that fires on every toolchain skew is noise that trains people to ignore it.

Proposal: source hash, not bytecode hash

At publish time, hash the contract's source inputs (the crate's tracked source files + its own Cargo.toml, sorted, content-hashed) and store the digest in the published metadata (which already gained storage_layout in #76 — same mechanism). At deploy time, when a contract resolves to up-to-date, recompute the local source hash and compare with the published one:

• match → silent skip, as today;
• mismatch → warn: "@org/foo 1.2.0 is up-to-date on-chain but local sources differ — did you forget to bump [package].version?" (warn, not error: comment-only edits and intentional no-publish work exist).

Toolchain-independent by construction. Known blind spot, acceptable for a warning: behavior changes that come only from other crates (a dependency bump) without touching this crate's sources won't trigger it.

Tasks

• Source-hash helper in cdm-builder (deterministic file set + digest)
• Include digest in publish metadata; tolerate absence when reading (older publishes)
• Compare + warn on the up-to-date path in the deploy pipeline; surface in the CLI table/summary
• Applies to the Solidity path too once its version source lands (see the Solidity-version issue)

References

#76 (idempotent deploys, storage_layout metadata precedent); src/lib/contracts/src/pipeline.ts (up-to-date path).

Start in src/lib/contracts/src/pipeline.ts at the up-to-date path, and trace the cdm-builder publish metadata and source inputs described in the issue. Check the metadata precedent from #76 and the Solidity-version issue. Done means deterministic source digests are published and read compatibly, mismatches warn in the deploy table or summary, and unchanged sources still skip silently.