[pselle]

What

Follow-up to #647. In v0.0.33, stellar scaffold generate contract --from oz/nft-royalties could still produce a contract that doesn't compile:

⚠️  Failed to update examples cache: HTTP status client error (403 Forbidden) for url (https://api.github.com/repos/OpenZeppelin/stellar-contracts/releases/tags/v0.8.0)
⚠️  Workspace stellar-tokens version doesn't match the example's 0.6.0 (example might not compile).
✅ Successfully downloaded example 'nft-royalties' to contracts/nft-royalties

Before downloading, the CLI called the GitHub releases API to look up the tag it had already pinned. When that call failed (403 is GitHub's response to the unauthenticated rate limit), it fell back to the newest release in the local cache. After an upgrade, that is the v0.6.0 cached by older CLI versions, so the 0.6.0 sources were copied into a 0.8.0 project.

Changes

• Drop the releases API call. The OZ tag is pinned, so it's used directly, and once it's cached nothing is fetched at all. The archive still comes from github.com/.../archive/<tag>.tar.gz, which isn't subject to the REST API rate limit.
• Remove the fallback to other cached versions (it also picked the "latest" tag by string comparison, which is wrong for both v0.10 vs v0.9 and the soroban-examples commit hash). If the pinned examples can't be downloaded, the command fails with the download error.
• Extract downloads into a temporary directory and rename into place on success, so an interrupted download can't leave a cache entry that's treated as complete.
• Replace the outdated "modify your environments.toml" hint with how to add the contract to scaffold.yml (type: workspace, source: <package name>, constructor args), matching the CLI docs. The --from-wizard instructions get the same update.

The --ls usage lines (contract generate → generate contract) are left for a separate PR.

Testing

• Cache holding only v0.6.0 (the reported state): with no network, the command now errors instead of copying v0.6.0 sources.
• Cache holding v0.6.0 and v0.8.0: uses v0.8.0 without any network call; the generated nft-royalties compiles in the UI template workspace.
• New unit test for the pinned-cache lookup ignoring stale releases; removed the tests for the deleted API helper. cargo test -p stellar-scaffold-cli --lib (241 passed), clippy and fmt clean.