[PR #36] forge-std submodule unpinned — non-reproducible builds and supply-chain risk

[obchain]

PR: #36 feat(contracts): Foundry workspace + CharonLiquidator skeleton

Problem: .gitmodules registers contracts/lib/forge-std tracking a branch (HEAD of foundry-rs/forge-std) rather than a pinned commit SHA. Every fresh git submodule update --init pulls whatever is at the tip of that branch at that moment.

Impact: Builds non-reproducible across machines and CI runs. A breaking change in forge-std (changed helper signatures, new deps, removed cheatcodes) silently breaks the test suite without any change to this repo's commit graph. Supply-chain hygiene issue: attacker who compromises forge-std could push malicious commit that is automatically pulled.

Fix: Pin submodule to specific commit SHA that was tested:

cd contracts/lib/forge-std
git rev-parse HEAD   # capture the SHA
cd ../..
git add lib/forge-std
git commit -m "chore(contracts): pin forge-std to <SHA>"

Add SHA to .gitmodules entry or document the pinned tag.

[obchain]

Fixed in feat/11-foundry-skeleton (7e184ed). forge-std was already pinned by gitlink to commit 2999b6563e1f07971a09d48b82f3fac910d72a05 (v1.15.0 + 15) in the parent repo's index; .gitmodules now documents the pin and explicitly records that no branch = line is set, so git submodule update always checks out the committed SHA rather than a moving tip. Builds are reproducible.