Cardano Updates

Move untrusted ${{ github.event.* }} / step-output values out of inline
script and shell bodies and into `env:` blocks, so attacker-controlled
data (workflow/check names, added filenames, refs, etc.) is read as inert
data via process.env / "$VAR" instead of being interpolated into the
source GitHub Actions parses. This closes script-injection vectors, the
most exploitable being the changed-files filename interpolation in
changelog-label.yml.

Files:
- slack-message-broker.yml: read all event fields from env; replace
  toJson(github.event) with JSON.stringify(context.payload).
- changelog-label.yml: read added_files / label flag from env.
- compare-golden-budgets.yaml, docusaurus-site.yml, haddock-site.yml:
  pass event/input values via env and quote shell expansions.

Also fix draft-PR notification filtering in slack-message-broker.yml,
which never worked: the check_run/workflow_run payloads carry only a
minimal PR object with no `draft` field (and the index was wrong), so
detection was always false; a dormant control-flow bug would also have
sent a message on drafts anyway. Now fetch the PR via the API to read its
real draft status (needs pull-requests: read), and suppress the
notification for draft PRs. Fork/push (no PR) and API errors fail open.

- explain bfm_live_<key_id>_<secret> structure and what key_id is
- add end-to-end request example with sample response
- note PATs don't expire (rotate/revoke only)
- add Errors table and Rate limits section

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

  The SQLite event store accumulates events from all head lifecycles without
  rotation. On restart, `aggregate` replays every persisted StateChanged event
  but unlike the live `handleChainInput` path, never checked that an event's
  headId matched the current state — so a HeadClosed or HeadFannedOut event
  from a previous head could silently drive an unrelated Open/Closed head into
  the wrong state.

  Fix: add `eventHeadId` and `headIdOf` helpers and a single pre-check at the
  top of `aggregate`. Any event whose headId does not match the current state's
  headId is silently dropped. Events that carry no headId are always applied,
  preserving existing behaviour for TransactionReceived, ChainRolledBack, etc.

  Regression tests cover the two critical cross-phase transitions:
  Open→Closed via HeadClosed and Closed→Idle via HeadFannedOut from a
  mismatched head.

- Remove all hardcoded fanout chunk size and threshold constants; fanout
sizing is now fully dynamic
- findFittingFanoutTx uses a binary search (findLargestFitting) to find
the largest UTxO chunk that fits within the protocol size limit and
script budget, checking both tx byte size and UPLC execution units
- findLargestFitting is a general-purpose monadic binary search exported
from Handlers.hs and reused in the tx-cost benchmark (replacing a local
copy)
- Property tests added for fitsTx (short-circuit, failure modes, real
Cardano protocol parameters), findLargestFitting (O(log n) call count,
exception propagation, monotone correctness), and UTxO splitting
(normal/overflow/empty cases with cover thresholds)


---

<!-- Consider each and tick it off one way or the other -->
* [x] CHANGELOG updated or not needed
* [x] Documentation updated or not needed
* [x] Haddocks updated or not needed
* [x] No new TODOs introduced or explained herafter