Feat/1187 protocol fixture provenance

[sebas11042]

Summary

Adds provenance and deterministic refresh automation for synthetic Soroban protocol fixtures.

• Records protocol and SDK versions, source hashes, and response digests.
• Detects missing, corrupt, or stale fixtures and supports atomic refresh with failure recovery.
• Adds CI integrity checks on Node 22/24/26 and scheduled/manual refresh artifacts for review.
• Documents maintenance, security considerations, and verification results.
• Synchronizes the lockfile with existing workspace manifests.

Closes #1187

How was this tested?

Local environment: Windows, Node 22.12.0, pnpm 9.15.3.

• pnpm run fixtures:protocol:check — fixtures are current.
• pnpm run test:protocol-fixtures — 13 tests passed.
• pnpm exec vitest run tests/unit/protocolFixtureCorpus.test.ts tests/unit/sorobanContractFixtures.test.ts --maxWorkers=2 --minWorkers=1 — 38 tests passed.
• Isolated corpus type-check, targeted lint and formatting, and governance validation passed.

Tests cover deterministic generation, valid SDK XDR, resource boundaries, invalid inputs, network isolation, corrupt or missing fixtures, atomic replacement failure, and recovery.

Full-repository checks are not passing locally. Existing blockers and reproducible verification steps are documented in the verification report. Remote CI remains unverified. No checks were disabled or bypassed.

Merge requirements

A PR is merged only when every box below is true. See Merge requirements for the full policy.

• All required CI checks pass on the latest commit (not just an earlier push).
• No required checks are failing, pending, or skipped — re-run or fix them; do not ask for a merge while any are outstanding.
• The branch has no merge conflicts with the target branch (rebase or merge master if GitHub shows "This branch has conflicts").
• Tests were added or updated for the change (primary flow, a boundary case, and a failure case).
• Docs were updated where behaviour, configuration, or security posture changed.

Security-sensitive changes

The new workflow is covered by .github/CODEOWNERS and requires code-owner review.

Fixtures contain synthetic testnet data. Generation makes no Stellar network requests and introduces no credentials or captured user data. Key handling, signing, session lifetime, and trusted endpoints are unchanged. Invalid metadata and network substitutions are rejected. Hashes detect drift but do not establish signed authenticity.

The workflow uses read-only repository permissions and non-persisted checkout credentials. Refresh candidates are uploaded as artifacts for human review; the workflow does not publish changes or write branches.

No UI controls or production bundle imports are added. Existing accessibility and performance requirements remain applicable.

• This PR touches a path covered by .github/CODEOWNERS (wallet, auth, cryptography, CI) and a code owner has been requested for review.
• I described any change to key handling, signing, session lifetime, or trusted endpoints above.

[vercel]

@sebas11042 is attempting to deploy a commit to the nanle-code's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@sebas11042 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits