Pin git dependencies to revs instead of branches

[madninja]

From a supply-chain review. Several dependencies ride git branches rather than pinned revs:

• [patch.crates-io] anchor-lang → personal fork, branch madninja/const_pubkey (root Cargo.toml)
• helium-proto → branch master
• msg-signature → branch master
• tuktuk-sdk → branch main
• squads-multisig-program → branch main

Cargo.lock pins exact commits today, but any fresh resolution (lockfile regenerated, downstream consumer without the lock) follows the branch tip. For the anchor patch and the multisig program this is the on-chain-money path.

Suggested fix: switch each to rev = "<sha>", and longer-term either upstream the anchor const_pubkey change or vendor it so the workspace doesn't depend on a personal branch staying alive.

[genisis0x]

The rev-pinning part of this landed in #551 — helium-proto, msg-signature, the anchor-lang patch, tuktuk-sdk and squads-multisig-program are now pinned to rev = "<sha>" instead of branch tips.

The only piece left from the original writeup is the longer-term note: the anchor-lang patch still points at the madninja/const_pubkey personal branch (pinned to a rev now, but a branch nonetheless), so upstreaming or vendoring that change is still open if you want to fully remove the personal-branch dependency.