Cardano Updates

Three improvements from PR review:

1. **BigUInt → u64 when it fits** (`convert.rs::unwrap_u64`). Previously
   any `BigUInt` variant unconditionally produced `ConvertError::Overflow`,
   even for values well within u64 range. u5c is free to encode positive
   values as `BigUInt(bytes)` instead of `Int(i64)` regardless of size,
   so the strict behavior halted workers on legitimate data. The
   converter now decodes BigUInt's big-endian byte representation
   (trimming leading zeros) and returns `Overflow` only when the value
   truly exceeds u64::MAX. Negative values and `BigNInt` still halt.

2. **Datum payload assertion** in
   `balius-core/tests/u5c_v017_wire_compat.rs::wire_compat_tx_output_roundtrips_via_017`.
   The test constructed a `BoundedBytes` payload but never asserted it
   after decode — a regression where hash/CBOR survive but payload
   mapping drifts would have gone undetected.

3. **Datum & WitnessSet roundtrip coverage** in
   `balius-runtime::ledgers::u5c::convert::tests`. The `roundtrip_opt`
   helper assumes Datum and WitnessSet share an identical wire format
   between utxorpc-spec 0.17 and 0.18 — a load-bearing assumption that
   was exercised only with `None` inputs. Two new tests round-trip
   populated values (datum with a BoundedBytes payload, witness set
   with both a VKey witness and a plutus datum) through `convert_tx_output`
   / `convert_tx` and decode under 0.17 prost. If 0.18 ever diverges on
   these types the test will catch it at CI time instead of as a silent
   decode error in production.

Tests: balius-runtime --lib goes 8 → 13 (3 BigUInt + 2 roundtrip);
balius-core unchanged at 4; e2e::faucet_claim still passes.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

The PParams wire shape — pbjson conventions from utxorpc-spec 0.17 —
deserved the same architectural treatment as Tx/UTxO: defined once in
balius-core, asserted with a wire-compat invariant test that proves
"what we emit, 0.17 decodes," and consumed unchanged on the runtime
and SDK sides.

Before: the shape lived implicitly inside a 100-line imperative JSON
builder in `balius-runtime::ledgers::u5c::convert::pparams_to_legacy_json`
that hand-assembled `serde_json::Value` to match pbjson. The SDK had a
parallel minimal PParams struct just for `coins_per_utxo_byte`. Two
mostly-implicit places to keep in sync; nothing in balius-core actually
owned the contract.

After:
 - `balius_core::proto::v0::cardano::PParams` + 7 nested types
   (RationalNumber, ProtocolVersion, ExUnits, ExPrices, CostModel,
   CostModels, VotingThresholds) own the wire shape via serde +
   serde_with derives: camelCase keys, u64 as JSON strings via
   DisplayFromStr, u32 as plain numbers, default-zero / None fields
   skip serialization. One source of truth.
 - The runtime converter shrinks to a flat `convert_pparams` that
   flattens upstream BigInts via `unwrap_u64` and field-copies into a
   `balius_core::proto::v0::cardano::PParams`. serde_json::to_vec on
   the typed value produces the wire bytes — no imperative JSON
   assembly. ~140 lines removed from convert.rs.
 - balius-sdk drops its inline PParams in favor of
   `pub use balius_core::proto::v0::cardano::PParams`.
 - balius-core/tests/u5c_v017_wire_compat.rs (renamed from
   wire_compat.rs for clarity) gains
   `wire_compat_pparams_roundtrips_via_017` mirroring the TxOutput
   test: build a balius-core PParams, serialize, decode under
   utxorpc-spec 0.17 pbjson, assert every field. Plus
   `wire_compat_pparams_omits_default_fields` for the skip-default
   invariant.
 - Runtime keeps `convert_pparams_decodes_under_017_pbjson` and
   `convert_pparams_overflow_propagates` — they cover the
   upstream-side BigInt seam (balius-core can't, no upstream dep).
   The now-redundant `convert_pparams_omits_default_fields` is dropped.

balius-core gains serde + serde_with as deps and serde_json as a dev-dep.

Verified: cargo check --workspace --tests clean; balius-core 4/4 (incl.
the two new PParams tests); balius-runtime --lib 8/8; e2e::faucet_claim
1/1 (full end-to-end through mock ledger). u5c-chainsync::wallet_balance
remains the pre-existing stale-wasm failure.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>