SeedSigner is interesting because they kinda roll their own O/S. I feel like in order to trust the results, you'll need someone who has the ability to reverse engineer binaries, which isn't a skill that most code auditing firms have.
I'd suggest a hybrid team. The code auditors with cryptography experience that everyone expects, and also some people to make sure the tooling that generates the image is trustworthy. The latter requires someone who can look at the binary and at least account for where all the machine code came from.
I'm not sure this affects the total cost of the project. Your estimate of hours seems high to me. Not every line of code is security-critical.
