feat: upgrade tool producing time-locked multisig wasm swap

[vally111]

• Add ProposalAction::UpgradeWasm(BytesN<32>) variant to multisig.rs with action tag 11; updates action_tag() match arm
• Add upgrade_tool.rs module with verify_manifest_hash(), execute_wasm_upgrade(), validate_upgrade_hash_env(), and UPGRADE_WASM_ACTION_TAG constant
• Add WasmUpgradeExecuted event struct and emit_wasm_upgrade_executed() to events.rs with TOPIC_WASM_UPGRADE_EXECUTED symbol
• Wire upgrade_tool module into lib.rs; dispatch_multisig_action redirects UpgradeWasm to execute_upgrade entry point with a clear error message

Security properties:

• Hash-binding: SHA-256 of supplied WASM must match proposal-committed hash
• Timelock: standard DEFAULT_PROPOSAL_EXPIRY window enforced
• Flash-vote resistance: vote-weight snapshot (issue Add governance vote-weight snapshotting at proposal creation to prevent flash-vote #512) applies
• Replay protection: nonce on create/execute prevents double-execution
• Null hash guard: all-zero hash rejected at proposal creation time
• closes Add time-locked upgrade tool for wasm hash swap validated via multisig #460