Cardano Updates

txtop#287 reports `panic: close of closed channel` in
Connection.shutdown at `close(c.connClosedChan)` when running
against a local cardano-node in Docker. shutdown is invoked from
exactly one goroutine spawned in setupConnection, but
setupConnection's own error paths (muxer-error goroutine -> Close
-> doneChan trigger during a partially-initialised connection)
and tests that close the underlying net.Conn out from under the
library have driven the cleanup into shutdown a second time,
which panics on the connClosedChan/errorChan closes.

Wrap the cleanup in sync.Once so subsequent calls are no-ops.
Close() already uses sync.Once for the doneChan close; adding a
symmetric guard on the cleanup side keeps the contract simple:
Connection cleanup runs exactly once regardless of who triggers
it.

Signed-off-by: SAY-5 <[email protected]>
Co-authored-by: SAY-5 <[email protected]>

Signed-off-by: Chris Gianelloni <[email protected]>

jemalloc handles concurrent allocation from rayon worker threads
better than glibc's ptmalloc2 (per-thread caches, less lock
contention) and returns freed pages more aggressively, reducing
RSS bloat from allocator fragmentation.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

Signed-off-by: Eric Torreborre <[email protected]>

productsign fails with errSecInteractionNotAllowed when the signing
keychain is locked, and can't find the identity if the keychain isn't
in the user's search list.

Fix: source signing.sh (which exports $KEYCHAIN), unlock the keychain,
and prepend it to the keychain search list before calling productsign.

Signed-off-by: KtorZ <[email protected]>

Signed-off-by: KtorZ <[email protected]>

docs: fix search

Co-authored-by: sg-doc-holiday[bot] <219201796+sg-doc-holiday[bot]@users.noreply.github.com>

Signed-off-by: Francisco Javier Ribo Labrador <[email protected]>

Updates yarn resolutions to address 15 open Dependabot security alerts.