crates.io does not host compiled artifacts. If packages on crates.io differ from their Git repository it's because of a custom pre-build step of that particular package, so a deterministic compilation toolchain won't help here.
- files not being tracked in the repo
- files being part of the repo not being part of the published crate
- publishing with allow dirty from a local copy of the repo with changes that haven't been committed
- publishing from a commit that hasn't been pushed
I'm sure there are more.
It definitely does contain generated files, at least one crate has Rust code generated by a Python script that is not in the crate, only in the upstream Git repository.