feat(queue-factory): add salt to deploy_queue to prevent front-running

[jajafwangshak86-ops]

Closes #206

Problem

QueueFactory::deploy_queue() deployed queues with the default (empty) salt, making the resulting contract address fully predictable from address(factory) + wasm_hash(queue.wasm) + salt. An attacker could pre-compute that address and front-run a legitimate deployment to seize/overwrite the queue address (especially risky for high-value product drops).

Fix

Added a salt: BytesN<32> parameter to QueueFactory::deploy_queue and pass it through to the Soroban deployer:

let contract_address = env
    .deployer()
    .with_current_contract(salt.clone())
    .deploy_v2(wasm_hash.clone(), ());

Because the address is derived from the salt, two deployments using the same factory + WASM but different salts now yield different contract addresses — deterministic for the operator, but not predictable by a third party who lacks the salt.

Acceptance test

test_same_wasm_different_salt_yields_different_addresses deploys twice from the same factory with the same WASM but two different salts and asserts the resulting addresses differ.

SDK & docs

• sdk/src/types.ts: added optional salt?: string to QueueDeploymentParams — when omitted the SDK auto-generates a random salt.
• docs/runbook-deployment.md: documented the --salt arg, the address derivation formula queue address = address(factory) + wasm_hash + salt, and random-salt guidance.

Supporting / housekeeping changes

These were required to make the Rust CI gates (test-rust, lint-rust) pass, and to unblock the pnpm-based CI jobs:

• SDK 22 migration of queue, enrollment, escrow, and identity test suites to the generated-client pattern (Address::generate, env.register(Type, ()), mock_all_auths()) — the stale direct-call pattern and removed APIs (Address::new, BytesN::new, direct Impl::method(env, ..)) no longer compile.
• Added #![cfg_attr(not(test), no_std)] headers so every contract builds for wasm32-unknown-unknown.
• Enabled +reference-types in contracts/.cargo/config.toml and the vendored host (wasmi_helper.rs) so deploy_v2 of reference-types WASMs works in native tests.
• examples/*/package.json: restored valid JSON (missing braces) so all pnpm workspace CI jobs can run.

Verification

• cargo fmt -- --check ✅
• cargo clippy -p lineproof-queue-factory -p lineproof-queue -p lineproof-enrollment -p lineproof-escrow -p lineproof-identity -- -D warnings ✅
• cargo test --workspace ✅ (90 tests)
• cargo build --target wasm32-unknown-unknown --release ✅
• pnpm --filter @lineproof/sdk typecheck ✅ / pnpm --filter @lineproof/sdk test ✅ / frontend typecheck ✅

Note: lint-backend / test-backend are blocked by pre-existing TS errors in backend/src/contracts/lineproofClient.ts (unrelated to this issue; out of scope — callers pass the wrong number of args to SDK client methods).

[vercel]

@jajafwangshak86-ops is attempting to deploy a commit to the Deejah Team on Vercel.

A member of the Team first needs to authorize it.