ci: enforce per-contract WASM size budgets

[Imole203]

ci: enforce per-contract WASM size budgets

Summary

contracts/stream/src/lib.rs is 260+ KiB of source and the workspace builds
three WASM contracts, but CI had no size gate. A contract that silently grows
past Soroban's practical upload ceiling becomes un-deployable and expensive to
upgrade. This PR adds a hard CI check.

Changes

script/check-wasm-size.sh (new)
Measures each release artifact and fails if it exceeds its budget:

┌──────────┬────────┐
│ Contract │ Budget │
├────────────────┼────────┤
│ fluxora_stream │ 256 KiB (262 144 bytes) │
├─────────────────┼─────────────────────────┤
│ fluxora_factory │ 128 KiB (131 072 bytes) │
├────────────────────┼─────────────────────────┤
│ fluxora_governance │ 128 KiB (131 072 bytes) │
└────────────────────┴─────────────────────────┘

Budgets include ~25% headroom above the June 2026 baseline. Supports
--optimized for checking post-optimizer artifacts. WASM_DIR is env-overridable
for local testing.

.github/workflows/ci.yml

New wasm-size-budget job (runs parallel to build, after lint):

1. Builds all three contracts — cargo build --release --workspace --target
   wasm32-unknown-unknown
2. Runs stellar contract optimize on each artifact (best-effort, non-fatal)
3. Hard gate on raw WASM size via check-wasm-size.sh — fails the job on breach
4. Informational pass on optimized sizes
5. Uploads all six artifacts for auditor download

docs/gas.md

New "WASM Size Budgets" section documenting: per-contract budgets, headroom
rationale, how to run the check locally, and the procedure for intentionally
raising a budget.

tests/test_gas_validation.py

10 new tests covering: all-pass, each contract independently over budget,
missing artifact, exact boundary, --optimized flag, executable bit, headroom
output, unknown flag. All 111 tests pass.

Testing

pytest tests/ -v # 111 passed

Security note

Size budgets are operational, not security-critical. A contract that cannot be
uploaded due to size is a liveness risk — the 25% headroom leaves room for
future features while keeping upload fees predictable. To raise a budget
intentionally, update the constant in check-wasm-size.sh and the table in
docs/gas.md in the same PR with justification.
closes #650

[drips-wave]

@Imole203 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Jagadeeshftw]

nice work adding per-contract wasm size budgets with the check-wasm-size.sh gate and the gas doc. merged everything except .github/workflows/ci.yml, which my account cannot push (it needs the workflow oauth scope) so someone with workflow permissions will need to add that ci.yml separately. the size-budget script and tests went in clean.