Cardano Updates

## Summary

Follow-up to #5271. This PR finishes the
`Cardano.Wallet.Primitive.Types.Tx.SealedTx` cardano-api decommission:
the primitive `SealedTx` module no longer imports `Cardano.Api`, and the
deprecated cardano-api-facing SealedTx exports are removed.

Base branch: `feat/drop-cardano-api-sealedtx` (#5271).
Rebased after #5270 merged, #5236 was rebased onto `master`, and #5271
was rebased onto #5236.

## What changed

| # | SHA | Purpose |
|---|---|---|
| 1 | `734f624` | Plan for finishing the SealedTx cardano-api
decommission |
| 2 | `80a3de4` | Port metadata extraction in `Shared/Transactions` to
ledger-native |
| 3 | `8faf76e` | Drop the dead cardano-api body in `addRequiredSigners`
|
| 4 | `a929e8e` | Migrate `buildAndSignTransactionPure` to ledger-native
seal |
| 5 | `e2e72af` | Drop the local `sealWriteTx` cardano-api bridge in
Server.hs |
| 6 | `0b619dd` | Remove the `SealedTx` cardano-api surface and move
remaining unit-test adapters local to tests |
| 7 | `b4da418` | Keep default sealed transaction byte decoding capped
at the supported Conway era, and make signing/decoding re-read sealed
bytes with the caller's preferred latest era |

## SealedTx surface removed

Removed from `Cardano.Wallet.Primitive.Types.Tx.SealedTx` and the
umbrella `Cardano.Wallet.Primitive.Types.Tx` export list:

- `cardanoTxIdeallyNoLaterThan`
- `sealedTxFromCardano`
- `sealedTxFromCardano'`
- `sealedTxFromCardanoBody`
- `getSealedTxBody`
- `getSealedTxWitnesses`
- internal `cardanoTxFromBytes`
- internal `cardanoApiTxToReadTx`

`sealedTxFromBytes'` now takes `Read.EraValue Read.Era` instead of
`AnyCardanoEra`, which lets the primitive module avoid `Cardano.Api`
entirely.

## CI fix after rerun

The first rerun of #5272 exposed a real Conway integration failure:
sealed Conway transaction bytes could be decoded as Dijkstra by the new
ledger-native default path, after which downstream code hit the
still-incomplete Dijkstra transaction support.

This PR now keeps the public `sealedTxFromBytes` default capped at
Conway, and the transaction layer re-decodes sealed bytes with the
preferred latest era supplied by the caller before signing or decoding.
That preserves the old "no later than current era" behavior without
restoring the cardano-api bridge.

## Remaining out of scope

- Removing `cardano-api` from `cardano-wallet-primitive.cabal`; other
primitive modules still import it.
- Removing `lib/cardano-api-extra/`.
- Full deletion of the old `Shelley/Transaction.hs` module.

## Test plan

- [x] `nix develop --command fourmolu --mode inplace ...` on touched
Haskell files
- [x] `git diff --check`
- [x] `nix develop --command just build 'cardano-wallet-primitive
cardano-wallet cardano-wallet-unit:unit'`
- [x] `nix develop --command cabal test cardano-wallet-unit:unit -O0 -v0
--test-options '--match="TransactionSpec"'`
- [x] `nix develop --command cabal test cardano-wallet-unit:unit -O0 -v0
--test-options '--match="SealedTx serialisation/deserialisation"'`
- [x] `nix develop --command cabal build cardano-wallet
cardano-wallet-api cardano-wallet-unit:unit --enable-tests
--enable-benchmarks --minimize-conflict-set -O0 -v0`
- [x] `rg 'Cardano\.Api|qualified Cardano.Api'
lib/primitive/lib/Cardano/Wallet/Primitive/Types/Tx/SealedTx.hs` returns
no matches
- [x] CI green on the rebased tip

Closes #5273.

## Why

Last night's nightly Release [run
#25536061161](https://github.com/cardano-foundation/cardano-wallet/actions/runs/25536061161)
shipped a Linux artifact built from the previous RC: tarball named
`cardano-wallet-v2026-05-05-linux64.tar.gz`, embedded `git revision:
1129e3a6…` (HEAD of `release-candidate/v2026-05-05`), even though the
runner had checked out `release-candidate/v2026-05-08` at `f4bdf3b54f…`.
macOS and Windows builds packaged the right revision; only the Linux
build went stale.

`Verify Linux` caught the discrepancy in the smoke test, but only
*after* the broken artifact had already been uploaded.

The root cause is not yet fully identified (issue #5273 has the
analysis). This PR doesn't try to fix the root cause — it makes the
failure mode more diagnosable and stops the broken artifact at the build
job rather than the verify job.

## What

Two new steps in the `build-artifacts` job in
`.github/workflows/release.yml`.

### 1. `Sanity-check checkout` — runs after `actions/checkout`

Asserts that:
- `git rev-parse HEAD` matches
`needs.prepare.outputs.release-candidate-commit`
- `lib/wallet/cardano-wallet.cabal`'s `version:` field (with the leading
`0.` stripped, matching `scripts/release/release-candidate.sh:42`)
matches `needs.prepare.outputs.release-cabal-version`

If either differs, the job fails before invoking `nix build`.

### 2. `Smoke test built artifact` — runs after `nix build`, before
`Upload artifact`

For Linux and macOS:
- Locate the archive in `result/`
- Assert its filename contains the expected git tag (e.g. `v2026-05-08`)
- Extract and run `cardano-wallet version`; assert the output contains
the expected git tag

For Windows: only the filename check runs (no wine on the build host;
`verify-artifacts` still does the wine-based version check).

For the Docker Image entry: matrix fields `extract: ''` and `binary: ''`
are empty, so the smoke-test step's `if: matrix.binary != ''` skip kicks
in.

## What I deliberately did *not* change

I considered but rejected three other proposals (full reasoning in
#5273):

- **Folding `gitrev` into the release-build derivation hash** — already
done. `gitrev` is interpolated into the `installPhase` string in
`nix/release-build.nix`.
- **Adding a `version` env attr in `nix/release-package.nix`** — already
done. The cabal version is embedded in the derivation `name` via
`walletLib.gitTagFromCabalVersion exe.meta.name`.
- **Hardening the `self.rev or "0000…"` fallback in `flake.nix`** — last
night's failure had a real-but-stale gitrev (`1129e3a6…`), not the
all-zeros fallback.

## Test evidence

Self-tested before requesting review.

**Negative control** ([run
#25552326078](https://github.com/cardano-foundation/cardano-wallet/actions/runs/25552326078)):
a throwaway branch deliberately patched
`scripts/release/release-candidate.sh` to skip the cabal-version sed, so
the resulting test-rc branch had the stale `0.2026.4.17` version while
prepare reported `release-cabal-version=2026.5.8`. The new `Sanity-check
checkout` step caught it on every platform with the expected error:

```
ERROR: cabal version (0.2026.4.17) does not match release-cabal-version (2026.5.8)
```

**Positive control** ([run
#25552442853](https://github.com/cardano-foundation/cardano-wallet/actions/runs/25552442853)):
clean `workflow_dispatch` on this PR's branch (`release_type: nightly`)
— should reach `Verify *` end-to-end without tripping the new steps. The
first attempt
([#25552279258](https://github.com/cardano-foundation/cardano-wallet/actions/runs/25552279258))
tripped the cabal check on a leading-`0.` formatting issue in the
comparison itself; that's the second commit on this branch.

## Test plan for reviewer

- [ ] CI on this PR is green
- [ ] Linked positive-control run reaches `Verify *` end-to-end
- [ ] Linked negative-control run fails at `Sanity-check checkout` with
the cabal-version error above

Binary's `version` output prints "<tag> (git revision: <sha>)".
Greppping for the tag alone is insufficient because a stale
same-day build can carry the right tag but a different commit.
Cross-check against `release-candidate-commit` so a substituted
binary from a prior in-day prep state is rejected before upload.

Per review on cardano-foundation/cardano-wallet#5274.

release-cabal-version (set by scripts/release/release-candidate.sh:42)
strips the leading 0. from the cabal version field, so the sanity
check needs to do the same to avoid spuriously failing every run.

Caught by self-test against PR #5274.

Deliberate desync to verify the new Sanity-check step in
build-artifacts catches a runner whose cabal version doesn't
match prepare's release-cabal-version output. Not for merging.

Refs cardano-foundation/cardano-wallet#5273.

## Summary

Progress toward removing `Cardano.Api*` from
`Cardano.Wallet.Primitive.Types.Tx.SealedTx`. Moves the first set of
production and test call sites off the deprecated surface. Follow-up
#5272 now finishes the remaining SealedTx cleanup.

Base branch: `001-drop-cardano-api` (#5236).
Rebased after #5270 merged and #5236 was rebased onto `master`.

## What this PR does

Eight bisect-safe commits:

| # | SHA | Effect |
|---|---|---|
| 1 | `04d65b2` | `docs`: plan document for the decommission series |
| 2 | `b4b87af` | Test helper `compareOnCBOR` -> raw `serialisedTx`
bytes, avoiding a cardano-api roundtrip |
| 3 | `282807d` | Submission path `_postSealedTx` -> `EraValue Read.Tx`
+ `consensusGenTxFromTxRecent`; deletes `unsealShelleyTx` /
`UnsealException` |
| 4 | `a6d0c9d` | `parsePartialTx` -> `deserializeTx :: Either
DecoderError (Read.Tx era)` per era |
| 5 | `f1ba908` | Delete `cardanoTxInExactEra` after the callers are
gone |
| 6 | `55f2bd9` | Add `sealedTxFromLedgerTx :: Read.IsEra era => Read.Tx
era -> SealedTx`; migrate `sealWriteTx` off
`toCardanoApiTx`/`sealedTxFromCardano'` |
| 7 | `e6feabc` | Add `sealedTxWitnessCount :: SealedTx -> Int` via
ledger witnesses; migrate Server.hs away from `getSealedTxWitnesses` |
| 8 | `c2ca434` | Integration test `getMetadataFromTx` ->
`Meta.getMetadata . Meta.getEraMetadata` on `EraValue Read.Tx` |

New ledger-native surface added to `SealedTx`:

- `sealedTxFromLedgerTx :: Read.IsEra era => Read.Tx era -> SealedTx`
- `sealedTxWitnessCount :: SealedTx -> Int`

Deleted:

- `cardanoTxInExactEra`
- `Cardano.Wallet.Primitive.Ledger.Shelley.unsealShelleyTx` /
`UnsealException`

## What this PR does not do

The deprecated SealedTx cardano-api exports are removed in #5272, not
here.

Out of scope:

- Removing `cardano-api` from `cardano-wallet-primitive.cabal`.
- Removing `lib/cardano-api-extra/`.

## Test plan

- [x] Rebased cleanly onto updated #5236 after #5270 merged
(2026-04-25).
- [ ] CI green on the rebased tip.