chore: add editorconfig, reproducible-build script, audit step summary, and testnet deploy script

[Darkdruce]

Summary

This PR implements four tooling/CI issues in a single change-set.

---

#102 — Add .editorconfig

Added .editorconfig at the repo root covering all file types present in the repository:

• Global defaults: UTF-8, LF line endings, final newline, trailing-whitespace trimming.
• .md: 2-space indent, trailing-whitespace preservation (for Markdown line-break syntax).
• .yml/.yaml: 2-space indent (matches existing CI YAML).
• .toml: 2-space indent (matches Cargo.toml).
• .sh: 2-space indent.
• .rs: 4-space indent, 100-char line length — baseline only; rustfmt owns the real formatting.

Closes #102

---

#103 — Add verify-build.sh (reproducible WASM build verification)

Added verify-build.sh with:

• Pinned RUST_CHANNEL (1.78.0) to lock the toolchain version.
• cargo clean before every build to eliminate stale artifacts.
• cargo build --locked to honour Cargo.lock exactly.
• RUSTFLAGS="" to prevent accidental flag injection.
• All relevant reproducibility settings already present in [profile.release] (single CGU, opt-level = "z", no debug info, symbol stripping) are documented in comments.
• Optional CONTRACT_ID argument: fetches the on-chain wasm via stellar contract fetch, computes its SHA-256, and compares it against the local hash.
• README updated with usage examples under a new Reproducible build verification section.

Closes #103

---

#104 — Surface cargo-audit CI results as a step summary

Updated the audit job in .github/workflows/ci.yml:

• Captures cargo audit output with set +e before writing the summary.
• Writes a `` block with a ✅ / ❌ heading, plain-English context, and the full cargo audit output in a fenced code block.
• Still exits with the original audit exit code so the job fails on real findings — behaviour is unchanged, visibility is improved.

Closes #104

---

#105 — Add deploy-testnet.sh (testnet deployment automation script)

Added:

• deploy-testnet.sh — reads config from deploy-testnet.env, runs cargo build --locked, stellar contract deploy, and stellar contract invoke ... initialize in sequence. Supports --skip-build to reuse an existing wasm.
• deploy-testnet.env.example — documents all required/optional config variables (ADMIN_ADDRESS, FEE_RECIPIENT_ADDRESS, BOND_TOKEN_ADDRESS, SOURCE_SECRET_KEY, NETWORK, optional WASM_PATH).
• .gitignore updated to exclude deploy-testnet.env and .last-deploy-testnet (the saved contract ID file).
• README updated with Automated / Manual deploy sections under Deploy (testnet).

Closes #105

---

What was tested

• Shell scripts checked for correctness (bash -n).
• CI YAML diff reviewed for correct indentation and step ordering.
• .editorconfig spot-checked against existing YAML, TOML, and Markdown files in the repo.
• README rendered locally to confirm formatting.

[drips-wave]

@Darkdruce Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits