Cardano Updates

* Hydra

* hydra

[ci skip]

Local socket access right warnings

Replaces console.log with silent error handling to prevent leaking error details
to stdout in production. Matches the error handling pattern used in JWT.verify().

Signed-off-by: A-Chronicle <[email protected]>

Add golden tests for the rest of the query result types

This commit introduces a general hierarchy for common era testing

Activates the must_hit:false cold_start emit from the prior commit.
publish-images will resolve the new tag, build asteria-game from
6a9a93b (which contains both the budget fix from PR #135 and the
must_hit:false fix from this branch), push, and the next master
cron + adversary dispatch will pull the new image.

Tagging the immediate commit instead of the eventual rebase SHA on
main: publish-images resolves the tag via `git rev-list -n 1 <tag>`,
which works as long as the tag exists in the repo's git history —
6a9a93b's parent is on main, so the tag will resolve cleanly even
after rebase merge.

PR #135 replaced sdk_unreachable in the cold-start path with
sdk_sometimes false to drop AlwaysOrUnreachable's hit:true +
condition:false finding mode. But sdk_sometimes hardcodes
must_hit:true, so the assertion now fails differently: the report
flags any must_hit:true Sometimes that only ever sees condition:false
("Sometimes assertions → stub eventually_alive cold_start: new",
3 examples on the first master verify run after the budget bump).

Add sdk_sometimes_optional which emits with must_hit:false. Same
shape as sdk_sometimes but never a finding — observation-only. Use
it for the cold_start emit since that branch isn't guaranteed to
be reached across all timelines (depends on whether a fault-cascade
window happens to coincide with an eventually_ dispatch).

The helper refactor adds an optional 8th argument to _sdk_emit
(default true). All existing callers keep their behavior. The new
sdk_sometimes_optional is a sibling of sdk_sometimes that passes
false for must_hit. sdk_unreachable, sdk_reachable, sdk_always
unchanged.

Smoke-tested locally — sdk_sometimes_optional false emits a JSONL
event with must_hit:false as expected.