You can use --remap-path-prefix to prevent embedding the full source file paths in the compiled artifacts. (one for ~/.cargo/registry` and one of the project dir) Other than that builds should in principle be reproducible across OSes I think.
One thing I could think of is that the -Cmetadata hash for the wasm artifact contains those of proc macros and build script fron dependencies, which have a different metadata hash as the host target is hashed into it.
Any string is valid. Rustc simply hashes all -Cmetadata arguments together with the crate name to form a "stable crate id" which is used to disambiguate between different crates even if they have the same name. One of the way it does this is by being hashed into the symbol names to ensure there are no conflicts. Cargo uses a hash of several different things as -Cmetadata argument.