ci: pin Foundry to v1.5.1 to avoid nightly drift

CI installed foundry 'nightly', which changes daily and quietly shifts
remappings auto-resolution, evm_version clamping, and fmt rules -- the same
class of drift that recently produced a non-canonical CREATE2 deploy address.

Pin all three foundry-toolchain installs (forge-test, forge-coverage, certora
verify) to v1.5.1, and document matching it locally via 'foundryup --install
1.5.1'. Verified v1.5.1 reproduces the canonical addresses exactly:
implementation 0x00000110dCdEdC9581cb5eCB8467282f2926534d and factory
0xBA5ED110eFDBa3D005bfC882d75358ACBbB85842.

Co-authored-by: OpenCode <opencode-noreply@coinbase.com>

Author: amiecorso

.github/workflows/certora.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@v1
         with:
-          version: nightly    
+          version: v1.5.1    
 
       - name: Run Forge build
         run: |

.github/workflows/test.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Install Foundry
         uses: foundry-rs/foundry-toolchain@v1
         with:
-          version: nightly
+          version: v1.5.1
 
       - name: Run Forge build
         run: |
@@ -54,7 +54,7 @@ jobs:
         - name: Install Foundry
           uses: foundry-rs/foundry-toolchain@v1
           with:
-            version: nightly
+            version: v1.5.1
 
         - name: Install forge dependencies
           run: forge install

README.md

@@ -95,6 +95,11 @@ Factory and implementation are deployed via [Safe Singleton Factory](https://git
 
 
 ## Developing 
+This repo pins a specific Foundry version so builds are byte-reproducible and deterministic deployments land on the canonical factory/implementation addresses. CI installs `v1.5.1` (see `.github/workflows/`); match it locally with:
+```bash
+foundryup --install 1.5.1
+```
+
 After cloning the repo, run the tests using Forge, from [Foundry](https://github.com/foundry-rs/foundry?tab=readme-ov-file)
 ```bash
 forge test