Cardano Updates

Signed-off-by: Yurii Shynbuiev <[email protected]>

Cloudflare now bypasses cache for /status/* paths, enabling real-time
SSE event delivery.

Bumps  and [minimatch](https://github.com/isaacs/minimatch). These dependencies needed to be updated together.

Updates `minimatch` from 9.0.5 to 9.0.9
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v9.0.5...v9.0.9)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v9.0.5...v9.0.9)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-version: 9.0.9
  dependency-type: indirect
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>

Bumps [minimatch](https://github.com/isaacs/minimatch) from 3.1.2 to 3.1.5.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v3.1.2...v3.1.5)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>

When Hydra resolves builds from cache, it creates only aggregate
"required" check-runs but not individual per-build check-runs.
This causes the GHA upload workflow to discover zero -env closures
and skip all container uploads.

Add a fallback path: when no Hydra check-runs ending in "-env"
are found, evaluate the store paths directly from the flake using
nix eval with extra/discover-env.nix. This ensures containers are
always uploaded regardless of Hydra's check-run behavior.

Also install Nix and checkout the repo in the Discover step to
support the fallback evaluation.

SSE through Cloudflare buffers events. Now the script polls the
bridge's one-shot endpoint every 120s as a safety net alongside
the SSE stream.

CDN proxies like Cloudflare may buffer SSE events, preventing real-time
delivery of status updates to the client. This caused the script to
hang indefinitely on the SSE stream even after the build completed.

Three fixes:

1. Periodic one-shot re-check: every 120s, poll the bridge's cached
   /status endpoint directly. This catches status changes even when
   SSE events are buffered or lost.

2. Reserve time for fallback: set curl --max-time to TIMEOUT - 120s
   so there's always 2 minutes left for one-shot re-check + polling.

3. Final one-shot re-check after SSE stream ends, before entering
   the polling fallback loop.

When Hydra resolves builds from cache, it creates only aggregate
"required" check-runs but not individual per-build check-runs.
This causes the GHA upload workflow to discover zero -env closures
and skip all container uploads.

Add a fallback path: when no Hydra check-runs ending in "-env"
are found, evaluate the store paths directly from the flake using
nix eval with extra/discover-env.nix. This ensures containers are
always uploaded regardless of Hydra's check-run behavior.

Also install Nix and checkout the repo in the Discover step to
support the fallback evaluation.

Bumps the npm_and_yarn group with 1 update in the /demos/next directory: [minimatch](https://github.com/isaacs/minimatch).
Bumps the npm_and_yarn group with 1 update in the /demos/next-oidc directory: [minimatch](https://github.com/isaacs/minimatch).
Bumps the npm_and_yarn group with 1 update in the /demos/next-sdjwt-workshop directory: [minimatch](https://github.com/isaacs/minimatch).


Updates `minimatch` from 5.1.6 to 5.1.9
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v5.1.6...v5.1.9)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v5.1.6...v5.1.9)

Updates `minimatch` from 6.2.0 to 6.2.3
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v5.1.6...v5.1.9)

Updates `minimatch` from 9.0.3 to 9.0.9
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v5.1.6...v5.1.9)

Updates `minimatch` from 5.1.6 to 5.1.9
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v5.1.6...v5.1.9)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v5.1.6...v5.1.9)

Updates `minimatch` from 6.2.0 to 6.2.3
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v5.1.6...v5.1.9)

Updates `minimatch` from 9.0.5 to 9.0.9
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v5.1.6...v5.1.9)

Updates `minimatch` from 5.1.6 to 5.1.9
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v5.1.6...v5.1.9)

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v5.1.6...v5.1.9)

Updates `minimatch` from 6.2.0 to 6.2.3
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v5.1.6...v5.1.9)

Updates `minimatch` from 9.0.3 to 9.0.9
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v5.1.6...v5.1.9)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-version: 5.1.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 6.2.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 9.0.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 5.1.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 6.2.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 9.0.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 5.1.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 6.2.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-version: 9.0.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>

The wait-for-hydra SSE mode now uses read -t 60 for periodic timeout
checks and re-checks the one-shot endpoint when the SSE stream ends.

Two fixes for SSE mode reliability:

1. Use `read -t 60` instead of blocking `read` so check_timeout fires
   every 60s even when the SSE stream is idle. Without this, if the
   stream goes idle (e.g. Cloudflare buffering, no new events), read
   blocks indefinitely and the script's TIMEOUT is never enforced.

2. After the SSE stream ends, re-check the one-shot endpoint before
   falling back to polling. This catches the case where the target
   status changed while we were connected but the SSE event was lost
   in transit (common with CDN/proxy intermediaries).

Signed-off-by: Chris Gianelloni <[email protected]>

* Centralize IOG library lists in iog-libs.nix

Extract the duplicated IOG dependency lists from dynamic.nix,
static.nix, cross-js.nix, and cross-windows.nix into a single
iog-libs.nix file. This eliminates manual synchronization when
adding new libraries (e.g., lmdb was previously missing from
cross-compilation targets) and provides a canonical source of
truth for IOG-specific dependencies.

The centralized file categorizes dependencies into:
- crypto: libblst, libsodium-vrf, secp256k1 (all shell types)
- data: lmdb (dynamic/static only)
- tools: cbor-diag, cddl, gh, icu, jq, yq-go (dynamic/static)
- cross-tools: cbor-diag, cddl (cross-compilation targets)

Each consumer imports iog-libs.nix and transforms as needed
(e.g., static.nix passes static=true to resolve static-* variants).

Addresses #56

* Fix ShellCheck SC2215 in wrapped-cabal script

Move the iog-libs.nix sync comment from inside the shell heredoc
(where it breaks line continuation and triggers SC2215) to a Nix
comment above the writeShellApplicationWithRuntime block.

The wait-for-hydra/sse-support branch now has the pipe subshell fix
(process substitution instead of pipe) so SSE exit codes propagate
correctly.