fix: bind deployment history proofs to canonical init hash

[AztecBot]

Summary

The deployment history helpers derived the initialization nullifier from a caller-supplied init_hash. A caller could pass a non-canonical hash and prove non-inclusion of a different nullifier, so this change checks the supplied hash against the canonical contract instance before either history proof derives the nullifier.

Fix

• Require init_hash to match get_contract_instance(contract_address).initialization_hash in both initialization history helpers.
• Add a focused regression for the negative helper's forged-hash path and update the positive wrong-hash expectation.

Testing

• ../../noir/noir-repo/target/debug/nargo test --package noir_aztec --exact history::deployment::test::assert_contract_was_not_initialized_by_rejects_noncanonical_init_hash --silence-warnings --test-threads 1 failed before the fix with Test passed when it should have failed
• ../../noir/noir-repo/target/debug/nargo test --package noir_aztec --exact history::deployment::test::assert_contract_was_not_initialized_by_rejects_noncanonical_init_hash --silence-warnings --test-threads 1
• ../../noir/noir-repo/target/debug/nargo fmt --package noir_aztec
• /home/aztec-dev/aztec-packages/noir/noir-repo/target/debug/nargo fmt --package test_contract
• ../../noir/noir-repo/target/debug/nargo test --package noir_aztec --no-run --silence-warnings
• /home/aztec-dev/aztec-packages/noir/noir-repo/target/debug/nargo test --package test_contract --no-run --silence-warnings
• git diff --check

Issues

• Closes AztecProtocol/aztec-claude#1201 — history non-existence init proof accepts non-canonical init_hash

---

Created by claudebox · group: kernels-audit-remediation