[huangji6693-max]

Summary

• Extend scripts/check-snapshots.mjs (pnpm snapshot:check) so that in addition to checking all 51 required contract snapshot categories under contracts/round/test_snapshots/test, it validates that:
  1. Every committed .json contract snapshot parses as a valid Soroban snapshot object (generators, auth, ledger, events).
  2. Committed dashboard demo evidence (apps/web/src/demo/demo-trace.generated.ts and apps/web/src/demo/demo-trace.checksum.ts) is present, matches LIFE_CYCLE_PHASES_CHECKSUM, includes all required lifecycle milestones (create_round, commit, open_reveal, reveal_all, settle), has matching bidder/agent/settlement/auditor evidence blobs, and contains no Stellar secret seeds.
• Add scripts/check-snapshots.test.mjs (pnpm snapshot:test) covering healthy repo snapshots, missing directories, missing snapshot categories, corrupted snapshot JSON payloads, stale dashboard milestone phases/checksums, and CI workflow enforcement.
• Add .github/workflows/snapshots.yml and wire check-snapshots.mjs + check-snapshots.test.mjs into .github/workflows/contract.yml.
• Document the snapshot health gate in docs/CI.md and README.md.

Supply-chain review

• No package scripts or dependencies changed. If changed, explain why below.
  • Added "snapshot:test": "node --test scripts/check-snapshots.test.mjs" to root package.json to run the snapshot health unit tests; no dependencies changed.
• No .vscode/, workflow, or other editor/config file changes. If changed, list them below.
  • Added .github/workflows/snapshots.yml and two steps in .github/workflows/contract.yml to run snapshot:test and snapshot:check in CI.
• No lockfile changes. If changed, explain the update below.
• No binary or font asset changes. If changed, list and justify them below.
• I confirm no automatic task (such as preinstall/postinstall) was added.
• I confirm no hidden executable payload (encoded blob, obfuscated command, or unexpected binary) was added.
• Any changed executable or binary was reviewed by a maintainer.

Testing

• node --test scripts/check-snapshots.test.mjs (7/7 tests passing)
• node scripts/check-snapshots.mjs (51/51 required categories + 119 snapshot JSON payloads + dashboard evidence healthy)
• node scripts/check-line-lengths.mjs & node --test scripts/check-line-lengths.test.mjs

Closes #521

[karagozemin]

I reviewed the diff and did not find a malicious payload, but this branch now conflicts with current main after related changes landed. Please rebase on current main, preserve the already-merged security and CI gates, rerun the relevant tests, and update this PR; it is not safe to merge the stale conflict state.

[huangji6693-max]

Thanks for the review @karagozemin! Rebased cleanly onto current main (docs/CI.md conflict resolved) and verified pnpm snapshot:test + pnpm snapshot:check pass.