feat(upgrade): add Soroban contract upgrade safety analyzer

[dragoncode-01]

Summary

Adds starforge upgrade analyze, a static safety analyzer that compares the current and candidate Soroban contract WASM files before an upgrade.

The analyzer detects potentially breaking interface and storage-layout changes, produces human-readable or JSON reports, and returns a non-zero exit code when breaking findings are present.

Changes

• Added the new command:

  starforge upgrade analyze \
    --current <old.wasm> \
    --candidate <new.wasm>

• Added confirmed interface diffing for:

  • Removed or renamed public functions
  • Changed argument types
  • Changed return types
  • Added functions
  • Unchanged signatures

• Added best-effort storage-key analysis for conventional DataKey and StorageKey contract types.

• Clearly distinguishes evidence confidence:

  • confirmed for contract-spec interface metadata
  • heuristic for inferred storage findings

• Added breaking, warning, and info risk classifications.

• Added JSON output and report persistence:

  starforge upgrade analyze \
    --current current.wasm \
    --candidate candidate.wasm \
    --format json \
    --output upgrade-analysis.json

• Added a versioned JSON schema for downstream CI validation.

• Suppressed decorative output automatically when JSON format is selected.

• Added CI documentation and a recommended GitHub Actions upgrade gate.

Exit Behavior

• Exits successfully when no breaking changes are found.
• Exits non-zero when at least one breaking finding is detected.
• Reports are emitted and saved before returning a breaking-change failure.

Storage Analysis Limitations

Standard Soroban contract metadata does not expose storage durability or stored value types. Storage findings are therefore explicitly marked as heuristic and recommend manual verification.

Testing

• Added paired-WASM tests covering additive and breaking upgrades.
• Added CLI integration tests verifying JSON output, report persistence, and exit codes.
• Added storage-key shape classification tests.
• All 194 library tests pass.
• Both new CLI integration tests pass.
• cargo check --all-targets passes.

Closes #60.