Cardano Updates

Signed-off-by: Chris Guiney <[email protected]>

The RecycleOnConfirm strategy retains a pendingRecycle entry until
the chain follower delivers a confirm or orphan event. If the tx is
silently dropped from the remote mempool (no event ever arrives),
the original inputs sit in pendingRecycle forever and the live UTxO
pool drains, eventually starving the builder.

Add a per-workload timeout sweeper async that ages out entries by
block depth. When a pendingRecycle entry's submission tip block
falls more than `recycle_timeout_blocks` behind the current tip,
the runtime fires an `onTimeout` callback which returns either
TimeoutRecycle (recycle original inputs back to the input queue,
same effect as the orphan path) or TimeoutDrop (give up on this
UTxO entirely). The default `recycle_timeout_blocks = 0` keeps the
sweeper off, so existing configs are unaffected.

The application-level callback in Main bumps a per-UTxO retry
counter and returns Drop once the count reaches the configurable
`recycle_max_retries` (top-level JSON field, default 3). This
bounds the damage from a single hostile or buggy input that would
otherwise re-time-out forever.

Spend-race hazard: if a tx lands on-chain *after* its inputs are
recycled, the follow-up tx the builder produces from those inputs
will be rejected by the node, and the input will re-time-out until
the retry cap is hit. The cap converts an unbounded retry loop
into a bounded one.

Observability:

* New BuilderTimeout trace (namespace TxCentrifuge.Builder.Timeout,
  severity Notice). Fields: builder, txid, retries, action
  (recycle | drop).
* BuilderQueueDepth gains two cumulative counters in its JSON
  payload: recycledTimeout, droppedTimeout. Stats fields are
  populated by the periodic queue-depth tracer async.

Plumbing:

* ObserverHandle gains `ohCurrentBlock :: STM Int`. The N2N and
  N2C TxIdSync state types expose `currentTipBlockNo` to satisfy
  it; the test harness adds a stub.
* Builder gains `timeoutAsync :: Maybe (Async ())` (Nothing for
  strategies without a pendingRecycle map, or when the sweeper is
  disabled).
* New TimeoutAction sum type in PullFiction.Config.Runtime.

The RecycleOnConfirm strategy retains a pendingRecycle entry until
the chain follower delivers a confirm or orphan event. If the tx is
silently dropped from the remote mempool (no event ever arrives),
the original inputs sit in pendingRecycle forever and the live UTxO
pool drains, eventually starving the builder.

Add a per-workload timeout sweeper async that ages out entries by
block depth. When a pendingRecycle entry's submission tip block
falls more than `recycle_timeout_blocks` behind the current tip,
the runtime fires an `onTimeout` callback which returns either
TimeoutRecycle (recycle original inputs back to the input queue,
same effect as the orphan path) or TimeoutDrop (give up on this
UTxO entirely). The default `recycle_timeout_blocks = 0` keeps the
sweeper off, so existing configs are unaffected.

The application-level callback in Main bumps a per-UTxO retry
counter and returns Drop once the count reaches the configurable
`recycle_max_retries` (top-level JSON field, default 3). This
bounds the damage from a single hostile or buggy input that would
otherwise re-time-out forever.

Spend-race hazard: if a tx lands on-chain *after* its inputs are
recycled, the follow-up tx the builder produces from those inputs
will be rejected by the node, and the input will re-time-out until
the retry cap is hit. The cap converts an unbounded retry loop
into a bounded one.

Observability:

* New BuilderTimeout trace (namespace TxCentrifuge.Builder.Timeout,
  severity Notice). Fields: builder, txid, retries, action
  (recycle | drop).
* BuilderQueueDepth gains two cumulative counters in its JSON
  payload: recycledTimeout, droppedTimeout. Stats fields are
  populated by the periodic queue-depth tracer async.

Plumbing:

* ObserverHandle gains `ohCurrentBlock :: STM Int`. The N2N and
  N2C TxIdSync state types expose `currentTipBlockNo` to satisfy
  it; the test harness adds a stub.
* Builder gains `timeoutAsync :: Maybe (Async ())` (Nothing for
  strategies without a pendingRecycle map, or when the sweeper is
  disabled).
* New TimeoutAction sum type in PullFiction.Config.Runtime.