feat(blueprints): pin blueprint metadata hashes onchain

[drewstone]

Summary

• add metadataHash to blueprint definitions, metadata getters, and blueprint lifecycle events
• store and enforce pinned metadata hashes in create and update flows, including metadata-lock enforcement on updates
• propagate the new field through bindings, indexer schema/config/handlers, and protocol tests

Why

Hosted blueprint metadata is fetched offchain today via metadataUri. This PR adds protocol-level hash pinning so clients can verify the fetched payload against an onchain digest and fail closed when metadata is tampered with.

Notes

• createBlueprint and updateBlueprint now require a nonzero metadataHash
• metadata updates now respect the existing blueprint metadata lock
• this is the protocol companion to the blueprint CLI PR that computes and submits canonical metadata hashes at deploy time

Validation

• forge test test/Tangle.t.sol
• forge test test/blueprints/BlueprintDefinitionStorage.t.sol
• cargo check -p tnt-core-bindings
• CI=true pnpm --dir indexer codegen
• CI=true pnpm --dir indexer typecheck

[drewstone]

This is the protocol base of the metadata-pinning chain.

Merge order:

1. tnt-core PR feat(blueprints): pin blueprint metadata hashes onchain #106
2. blueprint PR #1391
3. dapp PR #3158

Follow-up companions:

• blueprint: feat(tangle): pin blueprint metadata hashes in deploy manifests blueprint#1391
• dapp: feat(tangle-cloud): verify pinned blueprint metadata dapp#3158

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.