Cardano Updates

Signed-off-by: Chris Gianelloni <[email protected]>

trace-schemas: add namespace-driven schema generation and validation tooling

Added in order to be able to apply some function on the `txAuxData`
field of a transaction even when the `txAuxData` field is set to
`SNothing`.

added:
* github:input-output-hk/mithril/c2a30b996fdf1622436ecccde92253834060162c#mithril-client-cli
* github:input-output-hk/mithril/c2a30b996fdf1622436ecccde92253834060162c#mithril-signer

ci: upgrade GitHub actions

Picks up the composer + smoke-test fixes (08657c1, de9091a).
publish-images will resolve the tag → de9091a → rebuild
.#docker-image at that source.

Two strictness fixes after a CI run revealed the previous
gate would pass even when the composer driver emitted
"jq: invalid JSON text passed to --argjson" stderr noise:

* Wait for `p50_lovelace != null` instead of
  `populationSize > 0`. populationSize is the count of
  HD-derived addresses, which the refill code bumps on
  disk before the UTxO actually lands, so the previous
  check could green-light transacts before the indexer
  saw any UTxO. p50_lovelace stays null until the
  indexer observes a real UTxO.
* Capture stderr from each `parallel_driver_transact`
  invocation and grep for `^jq:`. The composer-side
  semantics treat exit 1 as "not applicable, retry next
  tick", so we keep tolerating non-zero exits — but a jq
  error on stderr means the driver itself crashed, and
  the smoke-test must surface that distinct from a
  legitimate not-applicable response.

Both parallel_driver_transact.sh and parallel_driver_refill.sh
were piping the daemon's REASON field straight into
`printf '{"reason":"%s"}' "$REASON"` to construct the
Antithesis SDK assertion details. The daemon's
SubmitRejected reason carries the raw ledger error string
(see cardano-node-clients
lib/Cardano/Node/Client/TxGenerator/Types.hs:135), which
can contain `"` and `\\` characters. Injecting those raw
into a JSON literal produced malformed JSON, and
`helper_sdk_lib.sh:_sdk_emit` then tripped on
`jq --argjson details <broken>` and dumped
"jq: invalid JSON text passed to --argjson" on stderr.

The script's terminating `exit 1` still ran (intended
"not-applicable, retry next tick" semantics), so the
composer kept advancing — but the SDK telemetry event was
silently dropped and the stderr noise polluted CI logs.

Switch to `jq -nc --arg r "$REASON" '{reason:$r}'` for the
reason path and `jq -nc --arg r "$RSP" '{raw:$r}'` for the
unknown-failure path. jq handles the JSON escaping, so any
quote/backslash/control char inside the daemon response
survives the round-trip without breaking the SDK emitter.

trace-schemas: add namespace-driven schema generation and validation tooling

The asteria-stub container becomes the long-running chain-following
indexer. Its main process is upstream `utxo-indexer` from
lambdasistemi/cardano-node-clients (PR #94, branch
034-cardano-tx-generator at d80ab59f), pinned via a flake input and
baked into the image by `nix build .#docker-image`. The indexer
follows relay1's chain over N2C, persists state to RocksDB at
/idx-db, and exposes ready/utxos_at/await on /tmp/idx.sock.

Replaces the per-component Dockerfile + apt + cardano-cli setup
with a pure-nix build (flake.nix + nix/docker-image.nix). cardano-cli
is no longer needed in this image because composer scripts now query
the indexer's socket directly.

Composer scripts (kept in their stub shape):
  - parallel_driver_heartbeat.sh — pings indexer's `ready`,
    Sometimes-true on processedSlot==tipSlot
  - eventually_alive.sh — post-fault: same probe with retries
  - finally_alive.sh — post-workload: same probe with retries

Compose updates:
  - mount relay1-state:/state:ro so the indexer can reach
    relay1's N2C socket
  - add asteria-stub-db named volume for RocksDB persistence
  - restart: always — workaround for upstream issue
    https://github.com/lambdasistemi/cardano-node-clients/issues/97
    (indexer crashes when relay1 closes the N2C socket; resume
    from RocksDB on auto-restart). Will revert this hack once
    upstream auto-reconnect lands.

The asteria-stub container becomes the long-running chain-following
indexer. Its main process is upstream `utxo-indexer` from
lambdasistemi/cardano-node-clients (PR #94, branch
034-cardano-tx-generator at d80ab59f), pinned via a flake input and
baked into the image by `nix build .#docker-image`. The indexer
follows relay1's chain over N2C, persists state to RocksDB at
/idx-db, and exposes ready/utxos_at/await on /tmp/idx.sock.

Replaces the per-component Dockerfile + apt + cardano-cli setup
with a pure-nix build (flake.nix + nix/docker-image.nix). cardano-cli
is no longer needed in this image because composer scripts now query
the indexer's socket directly.

Composer scripts (kept in their stub shape):
  - parallel_driver_heartbeat.sh — pings indexer's `ready`,
    Sometimes-true on processedSlot==tipSlot
  - eventually_alive.sh — post-fault: same probe with retries
  - finally_alive.sh — post-workload: same probe with retries

Compose updates:
  - mount relay1-state:/state:ro so the indexer can reach
    relay1's N2C socket
  - add asteria-stub-db named volume for RocksDB persistence
  - restart: always — workaround for upstream issue
    https://github.com/lambdasistemi/cardano-node-clients/issues/97
    (indexer crashes when relay1 closes the N2C socket; resume
    from RocksDB on auto-restart). Will revert this hack once
    upstream auto-reconnect lands.

Adds three subcommands under `drt newsfeed`:

- `release` — fetches installer metadata from a URL, builds a
  software-update + announcement pair with pre-filled hashes/URLs and
  localised text, opens \$EDITOR for review, then writes the newsfeed
  JSON and verification file.  Release notes URL defaults to the GitHub
  release tag derived from the fetched version.
- `publish` — uploads the current newsfeed JSON and verification file
  to an S3 bucket for end-to-end testing (--dry-run supported).
- `message` — adds a standalone announcement item with a configurable
  version target.

Common repo/env args (--env, --newsfeed-repo, --verification-repo) are
shared via a flattened NewsfeedRepoArgs struct and read from NEWSFEED_*
environment variables.

Adds a WAL_METADATA table to the redb WAL DB tracking a schema version,
checked at open(). Older or missing versions trigger a wipe-and-stamp;
newer versions return WalError::IncompatibleVersion to prevent an old
binary from destroying newer data. After a wipe, check_wal_in_sync_with_state
auto-reseeds the WAL from the state cursor (when fully defined) instead of
erroring, eliminating the manual `dolos doctor reset-wal` step.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

to fix the tests failing because of the new predicate failure