Cardano Updates

Pulls in master's current shared-image versions:
- sidecar:1ff6913       (post legacy-probe delete, #119)
- tracer-sidecar:5271661 (fork-tree probe build)
- configurator + log-tailer + tracer + cardano-node digests already match
- tx-generator from master is intentionally not added — adversary
  testnet runs nodes only

The adversary container itself stays pinned to its own SHA
(adversary:b75cfe3) since master has no adversary equivalent.

Layer 3 of #123 (perturbation metric emit from finally_tips_agree.sh)
is dropped: that script was deleted on main by #119, the cluster-wide
"did the cluster fork" oracle now lives in tracer-sidecar's fork-tree
probe. Re-implementing the perturbation metric on top of that surface
is a follow-up.

Adds Adversary.SDK with Reachable / Sometimes assertion emitters that
write to \$ANTITHESIS_OUTPUT_DIR/sdk.jsonl (default /tmp/sdk.jsonl).
Wires two assertions into app/Main.hs:

  - reachable("adversary_chain_sync_started", {target_host, point, limit})
    fires once per invocation before connectToNode. Antithesis report
    will show, segmented by target_host, "the adversary fired against
    pN at least once". A host that never gets attacked is visible as
    a missing Reachable hit.

  - sometimes(true|false, "adversary_chain_sync_completed",
              {target_host, tip|reason})
    fires once per invocation on completion. true on clean exit,
    false on connect/protocol failure. Sometimes-true vs Sometimes-
    false buckets quantify how often the adversary actually completed
    a full --limit sync vs being cut short by chaos.

Layer 1 of three for issue #123.

eventually_alive.sh / finally_alive.sh were exiting 1 in timelines
where Antithesis had killed the asteria-game container as a node
fault and the eventually_ check fired ~520ms after the container
respawned. The indexer's first-boot reconnect goes through
node-replaying with exponential backoff (1s, 2s, 4s, 8s, 16s … ≈
13 s by attempt 7) plus the N2C handshake and first-block write —
roughly 30-40s before tipSlot becomes non-null. The old 25 s budget
(15 s settle + 5×2 s retries) collided with that cold-start.

Bump SLEEP_SETTLE 15->30 and MAX_ATTEMPTS 5->15 in both scripts:
60 s budget. The probes still complete in well under the
post-fault window, and the script's contract ("indexer is at chain
tip within budget") is unchanged.

Investigation: see the failing example at vtime 132.9s on
b5698f4 — fault_injector logs show
  93.33  FAULT kill node target=["asteria-game"] dur=12.88
 107.26  containers_meta init+start asteria-game
 107.78  composer fires stub/eventually_alive.sh
 132.89  attempts_exhausted=5 last_reply.tipSlot=null

The ToCBOR/FromCBOR instances for EraBasedProtocolParametersUpdate
were previously stubbed with 'error' calls, which made any code path
using them blow up at runtime. The same problem propagated through
UpdateProposal, whose CBOR instances recurse into a Map containing
EraBasedProtocolParametersUpdate.

Implement them by routing through the ledger's PParamsUpdate encoding:
toCBOR converts via createEraBasedProtocolParamUpdate, fromCBOR
deserialises a PParamsUpdate and projects back via the existing
fromLedgerPParamsUpdate. The instance constraint tightens from
Typeable era to IsShelleyBasedEra era so we can dispatch on the era;
this propagates to UpdateProposal's instances.

Restore the prop_roundtrip_UpdateProposal_CBOR test that was deleted
when the stubs were introduced.

Signed-off-by: Akhil Repala <[email protected]>

Drops epochLength from 3600 to 240 slots so two full Conway epochs
fit comfortably inside Antithesis's 1-h test phase. The previous
3600-slot variant required ~2 h of vtime growth before the
bootstrap-producer's era-readiness predicate could ever hold,
which cannot be satisfied in a 1-h dispatch (today's 1h6m run
hit predicate satisfaction 0 times, all 39 producer attempts
exited rc=2 chain-not-era-ready).

Directory renamed for clarity. specs/080-amaru-self-bootstrap/
deliberately keeps the old name as historical record of the
original spec.

  Three cleanups spotted while reviewing the newLocalUTxO removal:

  - waitApplyTx and waitOnApplicableDecommit no longer pass the validated
    UTxO to their continuations (the callers stopped using it after the
    newLocalUTxO removal). Validation still happens; only the unused
    continuation arg is dropped.

  - pruneTransactions: rewrite from foldl' with `txs <> [tx]` (O(n^2))
    to guarded recursion with `tx : go u' rest` (O(n)). Threading the
    running UTxO through `go` is still required for validity checks
    on dependent txs.

  - TransactionReceived aggregate: replace `allTxs <> fromList [(k,v)]`
    with `Map.insert k v allTxs`. Same big-O class but eliminates the
    intermediate singleton-Map allocation per ReqTx.

  No behavioural change. Constant-factor wins on the per-ReqTx hot path.

Signed-off-by: Sasha Bogicevic <[email protected]>

Nixpkgs expects to drop support for intel macs in 26.11.

bootstrap-producer's era-readiness predicate requires
`slot >= 2*epochLength = 7,200`. With the default 1-second slot
length, Antithesis vtime under fault injection runs at ~1× wallclock,
so a 1-h budget caps the chain at ~3,600 slots — half the predicate.

Today's run (commit 5de10fff, session bafdf9ed3f06b0b7cbec33a92779d260)
showed exactly that: 39 producer attempts, 0 era-readiness
satisfactions, all transient rc=2 (chain-not-era-ready). amaru never
got past bootstrap.

slotLength: 0.36 s puts 2 epochs at ~43 wallclock minutes, leaving
~17 minutes for bootstrap + amaru run inside a 1-h test phase.
0.24 s would be even faster but starts risking leaders not finishing
block minting before the next slot — keep margin.

epoch length stays at 3,600 slots so the era boundaries the producer
walks remain unchanged.

  Few things:

  1. We were duplicating decoding logic regarding arrays and maps (which
     is particularly tedious) in the minicbor-extra; This is more
     cleanly done with a `WithSize` type wrapper as it allows to
     decouple the decoding logic from measuring the size of the decoded
     object (instead of having to rewrite specialized function for each
     type of structure).

  2. The TransactionBody and AuxiliaryData were already retaining
     information from their decoding, so we needed not the WithSize
     wrapper for them; but it's useful for the witnesses.

  3. All-in-all, the size is better calculated on-the-fly when iterating
     over transactions.

Signed-off-by: KtorZ <[email protected]>

Signed-off-by: KtorZ <[email protected]>

Signed-off-by: yHSJ <[email protected]>

Signed-off-by: yHSJ <[email protected]>

Signed-off-by: KtorZ <[email protected]>

* mithril-client from `0.14.7` to `0.14.8`