Cardano Updates

The build host runs ~28 GHA runners as a single user against one tmpfs
/tmp, so any job running `rm -rf /tmp/e2e-* /tmp/test-cluster*` on
`if: always()` wipes sibling runners' live VolatileDB files. Under
UTxO-HD (node >= 10.7.0) the consensus layer re-opens these files by
path and crashes with `FsResourceDoesNotExist` instead of tolerating
the unlink via open fd's, which manifested as the Conway Integration
Tests failure on master at 253d290bfd.

Point TMPDIR at \$RUNNER_TEMP — per-job, per-runner, auto-cleaned by
the runner service — so test clusters live in a private directory that
sibling runners cannot touch. Drop the now-redundant (and dangerous)
`rm -rf /tmp/...` cleanup steps from linux-e2e and release. Replace
the shared `/tmp/gha-bench` fixed path in benchmarks with RUNNER_TEMP
for the same reason.

## Summary

- Pin `nixfmt-rfc-style` and `cabal-fmt` in the dev shell so every
contributor and every CI job use the same version of every formatter.
- Add `just fmt` (runs `fourmolu` + `cabal-fmt` + `nixfmt`) and `just
check-fmt` (runs the CI script locally).
- Extend `scripts/ci/check-code-format.sh` so CI actually enforces
`nixfmt` on every tracked `*.nix` file.
- One-time sweep: normalise all `*.nix` with `nixfmt 1.1.0` so the tree
matches what CI now enforces. No semantic changes.
- Document the rule in `CONTRIBUTING.md` and
`docs/.../coding-standards.md`: **no drive-by reformatting.** A style
change and a semantic change must not share a commit, and formatter
switches are out of scope for feature/fix PRs.

## Why

PR #5258 re-formatted `flake.nix` unilaterally with `alejandra`, tucking
the formatter swap inside a 7-line feature. That pattern — mixing style
and semantics, plus changing formatter with no repo-wide decision —
makes diffs unreviewable and `git blame` useless. This PR closes the
loophole: one canonical formatter per language, pinned, CI-enforced,
documented.

## Commits

1. `style: normalise all *.nix files with nixfmt 1.1.0` — the one-time
sweep (1198/954 lines, formatter-only).
2. `chore(nix): pin formatters in dev shell, add just fmt, enforce
nixfmt in CI`.
3. `docs(contributing): pin formatters, ban drive-by reformatting`.

## Test plan

- [x] `just check-fmt` passes on a clean tree.
- [x] `just fmt` is a no-op on a clean tree.
- [x] Each commit individually evaluates the flake (`nix eval
.#cardano-wallet.name`).
- [x] CI green on PR.

Add windowsPackages attribute set built from ucrt64 cross-compilation,
including cardano-cli and cardano-node from cardano-node-runtime hydra
jobs. Expose both staticPackages and windowsPackages in the flake outputs
when the build platform is Linux.

Closes #5253

## Summary

Bump the wallet Nix Haskell projects from `ghc9122` to `ghc9123` and
re-enable `withHoogle` in the dev shell.

The original blocker was a `ghc-9.12.2` panic in the Hoogle/Haddock path
used by the wallet dev shell. Haddock crashed while building docs for
ledger packages (first observed in `cardano-ledger-mary-1.10.0.0`):

- `GHC version 9.12.2: tyConStupidTheta`
- symbol: `SubTx`

`SubTx` comes from ledger's `type data TxLevel = TopTx | SubTx`, so the
failure is a GHC/Haddock bug triggered by promoted/type-level data
constructors during documentation generation.

GHC `9.12.3` release notes include a directly relevant fix:

- `Fixed tyConStupidTheta to handle PromotedDataCon` (`#25739`)

On current `master` the shell workaround for that panic was `withHoogle
= false` in `nix/haskell.nix` (see commit `28a9e5f96a`). This PR bumps
the compiler to `ghc9123` and flips `withHoogle` back to `true`,
restoring in-shell Hoogle.

## What Changed

- `nix/haskell.nix` — `compiler-nix-name = "ghc9123"`, `withHoogle =
true`
- `nix/rewrite-libs/nix/project.nix` — `compiler-nix-name = "ghc9123"`
- `nix/set-git-rev/nix/project.nix` — `compiler-nix-name = "ghc9123"`

Total diff is four lines across three files. No application logic
changed.

## Why These Files

`nix/haskell.nix` controls the main `cardano-wallet` Haskell project and
the default dev shell. The `rewrite-libs` and `set-git-rev` helper
projects also carry their own `compiler-nix-name` pins; leaving them on
`ghc9122` would make the trial internally inconsistent and could hide
unrelated failures.

## Verification

Confirmed locally on the rebased branch (head on top of current
`master`, which already contains the `cardano-node 10.7.1` bump):

- `nix develop` completed with `ghc-9.12.3-env`.
- `withHoogle = true` rebuild produced `hoogle-with-packages.drv` and
`cardano-wallet-shell-env` with no `tyConStupidTheta` panic.
- `hoogle` in the shell resolves to
`…ghc-shell-for-packages-ghc-9.12.3-env/bin/hoogle` (the `withHoogle`
wrapper, not the bare binary).
- `hoogle search --count=3 "Text -> ByteString"` returned live
project-indexed results (`Cardano.Prelude`, `RIO.Prelude`, `RIO.Text`).

That verifies the Hoogle-enabled `nix develop` path that was previously
blocked by the `ghc9122` panic.

## Reviewer Guide

1. Root-cause evidence points upstream to GHC/Haddock, not to ledger or
wallet logic.
2. `9.12.3` has an upstream fix matching the observed panic.
3. Code change is deliberately minimal — four lines, nix-only.
4. Bumping the compiler and flipping `withHoogle` back on are one
logical change: bumping ghc without flipping is dead code in the shell,
and flipping without bumping reintroduces the panic. They ship as a
single commit.

## Follow-up

This PR does not claim Windows validation. If Windows-specific fallout
exists, it should be tracked separately from this narrow shell/Hoogle
unblocker.

cabal 3.16 expects 00-index.tar.gz in local repos but haskell.nix
mkLocalHackageRepo produces 01-index.tar.gz. Create a symlink via
the shellHook.

cabal 3.16 expects 00-index.tar.gz in local repos but haskell.nix
mkLocalHackageRepo produces 01-index.tar.gz. Create a symlink via
the shellHook.