Fix: `deploy-testnet.sh` does not pin Soroban CLI version

[legend-esc]

Labels: bug infrastructure

Description

deploy-testnet.sh installs soroban-cli without a version pin (cargo install soroban-cli). A breaking CLI update will silently break all testnet deployments without any indication of the cause.

Expected Behavior

Pin the Soroban CLI to the version tested with the contracts.

Steps to Reproduce

1. Run deploy-testnet.sh after a breaking Soroban CLI release.
2. Deployment fails with an obscure error unrelated to contract code.

Tasks

• Pin soroban-cli to a specific version in deploy-testnet.sh (e.g. cargo install --locked soroban-cli@21.0.0)
• Document the required CLI version in README.md prerequisites
• Add a version check at the start of the script that fails fast with a clear message if the wrong version is installed
• Update CI workflow to use the same pinned version