Cardano Updates

- golden-handles.txt: 25 commonly-known mainnet handles (cardano, hosky,
  minswap, bigpey, charles, ... incl. enterprise-address eth/satoshi/crypto),
  all verified present on mainnet. Names only — handles are transferable NFTs,
  so addresses are asserted by shape + round-trip, not pinned (drift-proof).
- run-golden-handles.sh: forward lookup (well-formed addr1.../stake1...) +
  reverse-by-payment-address round-trip for each golden handle.
- run-rest-spotchecks.sh: fix stdin/heredoc collision (data now passed via
  argv, not a pipe that the heredoc program shadowed) and switch the DB sampler
  to JSON output so arbitrary UTF-8 handle names parse safely; skip empty names.
- SKILL.md: document the golden step and files.

Validated live against the in-progress mainnet sync: golden 25/25, sample 10/10.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Remove the comment block above isDraftPullRequest() in
slack-message-broker.yml and the ref-validation comment in
haddock-site.yml.

Remove duplicate Block Forging.
Added cardano-node CPU load panel.
Added GC time panel.

Recent develop commits (test: network params and usedCostModelLanguages,
feat: pass protocol params to transform transaction) added source code
that uses 3.1.0-only exports (CostModels, PLUTUS_LANGUAGES,
CostModelLanguageName) but didn't refresh yarn.lock, so CI's yarn install
keeps the lockfile-pinned 3.0.2 and tsc fails. The dependency range
^3.0.2 already allows 3.1.0; this commit just re-resolves the lockfile.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Rework the user-facing API per review:

- Rename the flag to --allow-unrestricted-mode. It is now a *permission*,
  not a request: it authorizes hw-cli to use unrestricted mode if the tx
  requires it, but never forces it on a tx that doesn't.
- Auto-apply unrestricted mode when the tx structurally requires it (i.e.
  when no other mode would accept it). A new requiresUnrestrictedMode
  helper in util.ts encapsulates the detection; the initial trigger is a
  required_signers field without collateral inputs (ORDINARY and MULTISIG
  forbid required_signers, and PLUTUS is only auto-inferred when collateral
  is present). The set is extensible.
- determineSigningMode no longer takes the flag; it returns UNRESTRICTED
  automatically when required. The permission check now lives in
  commandExecutor: if the inferred mode is UNRESTRICTED, refuse unless
  --allow-unrestricted-mode was passed, and refuse if the connected
  device/app does not support unrestricted signing. The previous "graceful
  ignore + warn" path is removed; the flag is permission so an unsupported
  device must fail (the tx is unsignable anywhere else).
- New errors: UnrestrictedModeRequiredError and
  UnrestrictedModeUnsupportedByDeviceError.
- README and unit tests updated for the new flag and auto-detect semantics.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>