Cardano Updates

Replace individual huddle* test calls with the combined harnesses.
Types with Annotator instances use huddleCodecSpecFull, others use
huddleCodecSpecNoAnn. This adds anti-CBOR and Haskell roundtrip
coverage. Equivalence entries now covered by huddleCodecSpecFull
are removed from the bottom section.

Add windowsPackages attribute set built from ucrt64 cross-compilation,
including cardano-cli and cardano-node from cardano-node-runtime hydra
jobs. Expose both staticPackages and windowsPackages in the flake outputs
when the build platform is Linux.

Closes #5253

## Summary

Bump the wallet Nix Haskell projects from `ghc9122` to `ghc9123` and
re-enable `withHoogle` in the dev shell.

The original blocker was a `ghc-9.12.2` panic in the Hoogle/Haddock path
used by the wallet dev shell. Haddock crashed while building docs for
ledger packages (first observed in `cardano-ledger-mary-1.10.0.0`):

- `GHC version 9.12.2: tyConStupidTheta`
- symbol: `SubTx`

`SubTx` comes from ledger's `type data TxLevel = TopTx | SubTx`, so the
failure is a GHC/Haddock bug triggered by promoted/type-level data
constructors during documentation generation.

GHC `9.12.3` release notes include a directly relevant fix:

- `Fixed tyConStupidTheta to handle PromotedDataCon` (`#25739`)

On current `master` the shell workaround for that panic was `withHoogle
= false` in `nix/haskell.nix` (see commit `28a9e5f96a`). This PR bumps
the compiler to `ghc9123` and flips `withHoogle` back to `true`,
restoring in-shell Hoogle.

## What Changed

- `nix/haskell.nix` — `compiler-nix-name = "ghc9123"`, `withHoogle =
true`
- `nix/rewrite-libs/nix/project.nix` — `compiler-nix-name = "ghc9123"`
- `nix/set-git-rev/nix/project.nix` — `compiler-nix-name = "ghc9123"`

Total diff is four lines across three files. No application logic
changed.

## Why These Files

`nix/haskell.nix` controls the main `cardano-wallet` Haskell project and
the default dev shell. The `rewrite-libs` and `set-git-rev` helper
projects also carry their own `compiler-nix-name` pins; leaving them on
`ghc9122` would make the trial internally inconsistent and could hide
unrelated failures.

## Verification

Confirmed locally on the rebased branch (head on top of current
`master`, which already contains the `cardano-node 10.7.1` bump):

- `nix develop` completed with `ghc-9.12.3-env`.
- `withHoogle = true` rebuild produced `hoogle-with-packages.drv` and
`cardano-wallet-shell-env` with no `tyConStupidTheta` panic.
- `hoogle` in the shell resolves to
`…ghc-shell-for-packages-ghc-9.12.3-env/bin/hoogle` (the `withHoogle`
wrapper, not the bare binary).
- `hoogle search --count=3 "Text -> ByteString"` returned live
project-indexed results (`Cardano.Prelude`, `RIO.Prelude`, `RIO.Text`).

That verifies the Hoogle-enabled `nix develop` path that was previously
blocked by the `ghc9122` panic.

## Reviewer Guide

1. Root-cause evidence points upstream to GHC/Haddock, not to ledger or
wallet logic.
2. `9.12.3` has an upstream fix matching the observed panic.
3. Code change is deliberately minimal — four lines, nix-only.
4. Bumping the compiler and flipping `withHoogle` back on are one
logical change: bumping ghc without flipping is dead code in the shell,
and flipping without bumping reintroduces the panic. They ship as a
single commit.

## Follow-up

This PR does not claim Windows validation. If Windows-specific fallout
exists, it should be tracked separately from this narrow shell/Hoogle
unblocker.

Fix a few 1.0.0-rc.1 issues

Add a log-tailer sidecar that mounts the shared tracer volume
read-only and tails cardano-tracer ForMachine JSON per host.
Only events with sev in {Warning, Error, Critical} are emitted
to stdout, where Antithesis Logs Explorer indexes them as
source=log-tailer.

Rationale: Antithesis indexes container stdout only, so the rich
per-node trace stream that cardano-tracer writes to the tracer
volume never reaches the triage report. Severity filter keeps
load to ~0.3% of total tracer volume while surfacing every real
problem (ConnectionError, NotEnoughBigLedgerPeers, ShutdownArmedAt,
consistency warnings).

Verified: tailer survives producer kill (p1) and tracer kill;
picks up rotated files within a 15s poll; zero tailer restarts.

ReCon framework 1.1.0

Fixes #553 — replaced console.log with silent catch in verification
error path, consistent with JWT.verify behavior.

Fixes #554 — added exp and nbf temporal claim validation per
RFC 7519 §4.1.4 and §4.1.5. SDJWT.verify now returns false for
expired or not-yet-valid credentials.

Changes:
- Check exp claim before signature verification; return false if expired
- Check nbf claim before signature verification; return false if too early
- Remove console.log(err) from catch block (was leaking error details)
- Change import from type-only to value import for Domain (needed for
  runtime access to JWT.Claims enum)

Signed-off-by: abhigyan1102 <[email protected]>
Signed-off-by: Abhigyan Singh <[email protected]>

checkPartialFanout now verifies that headInValue equals headOutValue plus the sum of all distributed output values, preventing Ada theft via outputs not counted by the membership proof. The off-chain partialFanoutTx builder is updated accordingly to subtract distributed values from the continuing head output.

Signed-off-by: Eric Torreborre <[email protected]>