Cardano Updates

Dependency versions are managed by nix (haskell.nix) and
cabal.project constraints. The .cabal bounds were redundant
and added maintenance cost during dependency bumps.

Closes #5177

## Summary

### Upload bug fix
The `upload()` function used `find "$dir" $pattern` where `$pattern` was
`-name '*.tar.gz'` with embedded quotes. Shell expansion turned the
quotes into literal characters, so `find` never matched `.tar.gz` or
`.zip` files. Only the docker image (`-type f`) uploaded correctly.
Fixed by passing the file extension directly.

### Artifact verification
Added a `verify-artifacts` job between `build-artifacts` and
`create-release`:
1. Downloads each platform artifact
2. Extracts the archive
3. Verifies the binary exists
4. Runs `cardano-wallet version` smoke test (Linux/macOS — skipped for
Windows cross-compiled binaries)

`create-release` now depends on `verify-artifacts`, so corrupted builds
can't ship.

### Other
- Bump `download-artifact` v4 → v8

## Test plan

- [x] CI passes
- [ ] Manual `workflow_dispatch` release test with `test` type

Closes #5223

## Summary

Merge the v2026-03-31 release candidate branch back to master to sync
cabal version numbers.

Dependency versions are managed by nix (haskell.nix) and
cabal.project constraints. The .cabal bounds were redundant
and added maintenance cost during dependency bumps.

Closes #5177

## Summary

- **release-candidate.sh**: Guard all version bump commits with `git
diff --quiet ||` so the nightly release doesn't fail when re-run on the
same day (the swagger/cabal/README sed replacements are no-ops, `git
commit` finds nothing to commit and exits 1)
- **All workflows**: Bump `actions/checkout` v4 → v6 and
`actions/upload-artifact` v4 → v7 to fix Node.js 20 deprecation warnings

Fixes the nightly release failure:
https://github.com/cardano-foundation/cardano-wallet/actions/runs/23882995758/job/69639871045

## Test plan

- [ ] Nightly release workflow succeeds
- [x] CI passes

checkout v4 → v6, upload-artifact v4 → v7

Guard all version bump commits with `git diff --quiet ||` so the
script doesn't fail when re-run on the same day (sed makes no
change, git commit finds nothing to commit).

## Summary

### Flake input updates
- **iohk-nix**: Remove hardcoded `?rev=` pin to personal branch
`hkm/update-blst` — blst v0.3.14 is already on master
- **mithril**: Update from `2543.1-hotfix` to latest stable release
`2603.1`
- **haskell.nix + hackage.nix**: Update to latest master

### Nix fixes
- **ruby 3.1 → 3.3**: `ruby_3_1` removed in newer nixpkgs pulled by
haskell.nix update
- **mdbook-mermaid overlay**: Pin to 0.16.x — haskell.nix's nixpkgs
ships mdbook-mermaid 0.17 (requires mdbook 0.5) but still has mdbook
0.4.52

### CI improvements
- **Build Gate (Windows)**: Extract Windows cross-compilation into its
own visible build gate
- **Attic Cache dependencies**: Now waits for all three gates (quality,
artifacts, windows) before pushing — no more redundant rebuilds
- **actions/checkout v4 → v6**: Fix Node.js 20 deprecation warnings
- **actions/upload-artifact v4 → v7**: Fix Node.js 20 deprecation
warnings

### HLint fixes
- Resolve 7 new warnings from updated HLint version (redundant toList,
use flip, move reverse out)

## Test plan

- [x] All unit tests pass
- [x] Conway integration tests pass
- [x] Local cluster tests pass
- [x] Docs build passes (mdbook-mermaid overlay verified)
- [x] HLint passes
- [x] Build Gate (Linux, macOS, Dev Shell, Artifacts) pass
- [x] Build Gate (Windows) visible as separate check

Closes #5218, closes #5219, closes #5220

Extract Windows cross-compilation from Attic Cache into its own
visible build gate. Attic Cache now depends on all three gates
(quality, artifacts, windows) and only pushes to cache.

- Remove redundant toList calls (Foldable constraint suffices)
- Use flip instead of section application
- Move reverse out of pipeline

- iohk-nix: remove rev pin to personal branch hkm/update-blst
  (blst v0.3.14 is now on master)
- mithril: update from hotfix/2543.1 to release 2603.1
- haskell.nix + hackage.nix: update to latest master
- ruby_3_1 → ruby_3_3: ruby 3.1 removed in newer nixpkgs

Closes #5218, closes #5219, closes #5220

haskell.nix's nixpkgs ships mdbook-mermaid 0.17 which uses
mdbook-preprocessor 0.5 (requires mdbook 0.5), but still has
mdbook 0.4.52. Pin mdbook-mermaid from the previous nixpkgs
until haskell.nix bumps mdbook.

- Remove redundant toList calls (Foldable constraint suffices)
- Use flip instead of section application
- Move reverse out of pipeline