[FEAT] Add CI checks for cofhe-contracts

[roeezolantz]

Summary

Adds a comprehensive CI pipeline (checks.yml) with 5 parallel jobs to catch issues before merge. The existing test.yml is untouched.

• Storage layout snapshot validation — prevents accidental storage slot changes that would brick UUPS upgrades for TaskManager, ACL, and PlaintextsStorage
• Contract size enforcement — enforces the 24KB EVM bytecode limit (currently masked by Hardhat's allowUnlimitedContractSize: true)
• Solhint linting — static lint with project-specific rule overrides matching existing code patterns
• Slither static analysis — catches medium+ severity findings (informational/optimization excluded)
• Gas reporting — runs tests with hardhat-gas-reporter and uploads the report as a CI artifact

New Files

File	Purpose
.github/workflows/checks.yml	CI workflow with 5 parallel jobs
tasks/storageLayout.ts	Hardhat task: extract & validate storage layout via @openzeppelin/upgrades-core
tasks/checkContractSize.ts	Hardhat task: enforce 24KB bytecode limit, warn at 22KB
.solhint.json	Solhint config (extends solhint:recommended)
.solhintignore	Excludes node_modules/, contracts/tests/, contracts/detereministic-tm/
slither.config.json	Slither config (filter paths, exclude informational, fail on medium+)
storage-layout-snapshot.json	Initial storage layout snapshot

Modified Files

File	Change
tasks/index.ts	Exports new tasks
package.json	Added solhint devDep + scripts: storage-layout:generate, storage-layout:check, check:size, lint:sol
hardhat.config.ts	Added gasReporter config (gated by REPORT_GAS env var)

New Scripts

pnpm storage-layout:generate  # Generate/update storage-layout-snapshot.json
pnpm storage-layout:check     # Validate current layout matches snapshot (CI)
pnpm check:size                # Check contract sizes against 24KB limit
pnpm lint:sol                  # Run Solhint

Local Verification

All checks pass locally:

pnpm compile             ✅
pnpm test                ✅ 32/32 passing
pnpm lint:sol            ✅ (1 warning: unused Strings import in TaskManager.sol)
pnpm storage-layout:check ✅
pnpm check:size          ✅ TaskManager 66.8%, ACL 37.2%, PlaintextsStorage 9.2%, ERC1967Proxy 0.4%

Current Contract Sizes

Contract	Size	% of 24KB Limit
TaskManager	16,428 bytes	66.8%
ACL	9,130 bytes	37.2%
PlaintextsStorage	2,258 bytes	9.2%
ERC1967Proxy	100 bytes	0.4%

Notes

• Solhint flags an unused Strings import in TaskManager.sol as a warning (not error). Consider removing it in a follow-up.
• Slither job uses crytic/slither-action@v0.4.0 with solc 0.8.25 pinned.
• Gas report is uploaded as a CI artifact with 30-day retention.

Test plan

• Verify checks.yml CI jobs all pass on this PR
• Confirm existing test.yml is unaffected
• Modify a storage slot locally and verify storage-layout:check fails
• Verify Slither doesn't produce false-positive medium+ findings