Add pins to dependency height

[jribbink]

Closes #2243

Description

Adds block_height pins to DM dependencies.

• Behavioiur remains backward-compatible, however, depdedencies can now be historically backfilled on new machines/CI without requiring a manual update step.
• Migration/block_height pins will be added after the first install after updating.
• Post-migration flow.json is still backward-compatible with old CLI version, and will just ignore the unknown field

---

For contributor use:

• Targeted PR against master branch
• Linked to Github issue with discussion and accepted design OR link to spec that describes this work
• Code follows the standards mentioned here
• Updated relevant documentation
• Re-reviewed Files changed in the Github PR explorer
• Added appropriate labels

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codecov-commenter]

Codecov Report

❌ Patch coverage is 80.18018% with 22 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/dependencymanager/dependencyinstaller.go	80.18%	16 Missing and 6 partials ⚠️

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

This PR adds block height pinning to Flow dependency manager, enabling reproducible dependency installation across machines and CI environments. Dependencies are now frozen to specific blockchain block heights, ensuring consistent contract versions.

Key changes:

• Block height tracking for each dependency with automatic pinning on install
• Historical contract retrieval using GetAccountAtBlockHeight for pinned versions
• Backward-compatible migration (zero block heights auto-migrate to latest)
• Spork recovery logic to handle inaccessible historical blocks

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.

File	Description
internal/dependencymanager/dependencyinstaller.go	Implements block height caching, historical contract fetching, spork recovery, and cross-network duplicate detection
internal/dependencymanager/dependencyinstaller_test.go	Comprehensive test coverage for block height pinning scenarios including new dependencies, migrations, spork recovery, and caching
go.mod	Updates flowkit dependency and promotes flow-core-contracts to direct dependency
flowkit/schema.json	Adds block_height and canonical fields to JSON schema for dependencies

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.