Cardano Updates

Signed-off-by: Chris Gianelloni <[email protected]>

Signed-off-by: Chris Gianelloni <[email protected]>

Extract two helpers in LeiosLateJoinState so the production node boot and
the threadnet harness set up late-join the same way and cannot drift.

setLateJoinHooks sets the three late-join ChainDbArgs fields (the
ignore-set plus the seed and register hooks). forkLateJoinWorkers forks
the three background loops (trigger worker, AcquiredEbTxs subscriber, GC
pruner) on the node registry after the ChainDB is open.

Node.hs runWith now builds the LeiosKernel late-join state and routes
through both helpers; it did not wire late-join before. Network.hs
replaces its inline ChainDbArgs field-setting and loop forking with the
same two calls.

When GHC's configure is regenerated here via autoreconfHook using a host
autoconf >= 2.72, AC_PROG_CC probes for and appends the newest C standard
flag the compiler accepts (e.g. -std=gnu23 with clang 21) to $CC. GHC then
bakes $CC verbatim into the "C compiler command" / "C++ compiler command" /
"Haskell CPP command" settings fields. On aarch64-darwin with nixpkgs
nixos-26.05 (autoconf 2.73, clang 21) GHC therefore tries to exec a binary
literally named "cc -std=gnu23" and fails at configurePhase of the first
package it compiles:

  ghc-9.8.4: could not execute: /nix/store/...-clang-wrapper-21.1.8/bin/cc -std=gnu23

nixpkgs' own GHC is unaffected because it ships GHC's pre-generated configure
(no autoreconf), so the std flag never lands in the command field.

Move the std flag out of each command field into its matching flags field in
postInstall, mirroring the existing Windows dllwrap/windres settings fixup.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Signed-off-by: Chris Gianelloni <[email protected]>

* mithril-aggregator from `0.9.7` to `0.9.8`
* mithril-client-cli from `0.13.15` to `0.13.16`
* mithril-common from `0.7.4` to `0.7.5`
* mithril-stm from `0.10.34` to `0.10.35`
* openapi.yaml from `0.1.65` to `0.1.66`

Feed the ancillary proof input into multi-signature creation and persist the returned verifier data on the certificate.

Build the aggregate signature ancillary input from the genesis and parent certificates and store the produced verifier data on the certificate.

Signed-off-by: Yurii Shynbuiev <[email protected]>

Carry the prover input into the clerk, return the verifier data alongside the aggregate signature, and accept optional verifier data on verification.

Wrap the STM ancillary types in ProtocolKey (bytes hex codec), add optional prover and verifier fields to Certificate, and fold them into its hash.

Add nullable ancillary columns (migration 44) and thread the data through the certificate record conversions.

Proof-system-agnostic carriers with versioned CBOR to_bytes/from_bytes per CODEC.md; no variants yet.

The Windows `Check` CI job failed compiling `[email protected]`'s C feature
tests (`c11.c`) under the runner's new MSVC toolchain (VS 18 / 14.51), which
GitHub is rolling out as it redirects windows-latest to windows-2025-vs2026.

Bump the rustls crypto backend, which transitively pulls a newer aws-lc-sys
that supports current compilers:

- aws-lc-rs  1.13.3 -> 1.17.0
- aws-lc-sys 0.30.0 -> 0.41.0

Lockfile-only change (transitive deps; the aws-sdk crates were already
current). Verified `cargo build --features aws` compiles locally; Windows
build is validated by CI.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

chore(ci): extend timeout for e2e workflow to 120 minutes