Fix workspace manifest, duplicate/false-positive checks, and TTL auth false positives

[valoryyaa-byte]

Fixes four Stellar Wave issues in the checks/analyzer crates.

Changes

• [CRITICAL] [build] Root Cargo.toml is missing workspace.package fields referenced by every crate #256: Added the missing readme = "README.md" field to [workspace.package] in the root Cargo.toml (keywords/categories were already present). Unblocks manifest parsing for every crate.
• AuthAfterStorageWriteCheck is registered twice, and scan_directory_with_checks never deduplicates — real scans emit duplicate findings #371: default_checks_with_config() now derives its list from all_checks_base() (swapping in the config-driven UnprotectedAdminCheck instance) instead of maintaining a second hand-written 35-item list, so a check can no longer be registered twice in one list but not the other. scan_directory_with_checks — the function the CLI actually calls — now deduplicates findings per file, matching scan_directory/scan_files. Added a test asserting no duplicate check names in default_checks()/default_checks_with_config(), and a CLI-level test scanning a fixture that trips auth-after-storage-write, asserting exactly one finding via scan_directory_with_checks.
• Four checks never adopted the #232 self-scan fix — all walk the raw syn::File instead of contractimpl_functions_excluding_test #375: UnsafeRandomnessCheck walked the raw syn::File via visit::visit_file, so it would flag #[contractimpl] blocks inside #[cfg(test)] modules. Switched it to iterate contractimpl_functions_excluding_test like the rest of the checks, and added a regression test with a #[cfg(test)] mod tests fixture. The other three checks named in the issue (unprotected_upgrade, unprotected_token_mint, unprotected_contract_deployment) already used contractimpl_functions_excluding_test with matching regression tests in this checkout — only unsafe_randomness.rs needed the fix.
• extend_ttl/bump are counted as storage mutations by both auth checks — TTL bumps are flagged as unauthorized writes #401: Lifted the storage-mutation-call heuristic out of auth.rs/auth_order.rs into a single crate::util::is_storage_mutation_call, dropping extend_ttl/bump from the matched method names (kept set/remove/append). TTL extension is a permissionless, non-mutating operation in Soroban and shouldn't be flagged by missing-require-auth or mis-ordered by auth-after-storage-write. Added a test to each check asserting a function whose only storage call is extend_ttl produces no finding, and updated the docs/checks.md limitations text for both checks.

Closes #256
Closes #371
Closes #375
Closes #401

[drips-wave]

@valoryyaa-byte Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits