Cardano Updates

Add batch-wide withdrawal bound check to prevent phantom asset attacks
when nested transactions combine deposits and withdrawals.

`Transaction.lagda.md`:
+  Define allWithdrawals batch aggregation helper (mirrors
   allDirectDeposits)

`Utxo.lagda.md`:
+  Define NoPhantomWithdrawals predicate using allWithdrawals
+  Add NoPhantomWithdrawals premise to UTXO rule
+  Document phantom asset attack and spend-side safety analogy

`Utxo/Properties/Computational.lagda.md`:
+  Update Computational-UTXO for new premise tuple arity (21+h → 22+h)

ghc967 makes ghc-iserv flaky for Windows TH cross-compilation. Switch to
ghc9122 (matching cardano-node's approach) and ucrt64 target to align
with GHC 9.12's native UCRT linkage and avoid C runtime mismatches that
cause iserv to hang on TH evaluation.

Signed-off-by: Chris Guiney <[email protected]>

Signed-off-by: Chris Guiney <[email protected]>

When descending into lambda bindings, the shift counter is used to determine
whether a DeBruijn index points to a bound variable that should be left
untouched. The original code used  which could incorrectly
discharge a free variable when  exactly equaled the index.

Changed the comparison to  so a variable is only discharged
when the current shift *exceeds* its DeBruijn index. This preserves free
variables when  equals the index and resolves the bug reported in
plutus issue #7526.

Testing will verify that the change does not affect existing functionality.

Remove the daedalus-installer Haskell executable (which required a GHC
version removed from nixpkgs-25.11) and generate the two NSIS scripts
(daedalus.nsi, uninstaller.nsi) directly as Nix writeText derivations.
All inputs are known at eval time so no build-time Haskell tool is needed.

Replace the ad-hoc nix/ directory and flake-utils setup with a
flake-parts structure mirroring hermod-tracing:

- flake.nix: adopt nixConfig cache block, flake-parts, haskell.nix +
  hackageNix + CHaP; remove devx and flake-utils
- flake/lib.nix: recursiveImports helper for auto-discovering perSystem
- perSystem/project.nix: cabalProject' for cardano-addresses (ghc967)
- perSystem/devShells.nix: shellFor with cabal/ghcid/HLS tools
- perSystem/packages.nix: library, exe and unit test check
- perSystem/haddocks.nix: haddock index package (ghc967)
- perSystem/hydraJobs.nix: required/nonrequired aggregates; Darwin in
  nonrequired
- perSystem/wasm.nix: wasm32-wasi cross-build via projectCross.wasi32
  (ghc9123) with haskell.nix native toolchain; module overrides for ram
  and crypton hsc2hs/C flags
- perSystem/windows.nix: mingwW64 cross-build via projectCross.mingwW64
- perSystem/musl.nix: static x86_64 binary via projectCross.musl64
- cabal-wasm.project: add --sha256 pins for source-repository-packages
- Remove nix/wasm.nix and nix/supported-systems.nix
- Remove old CI workflows (haskell, nix, style, wasm); replace with
  unified pages workflow building Docusaurus + Haddocks
- docusaurus.config.js: update to cardano-addresses.cardano.intersectmbo.org

Signed-off-by: Jenita <[email protected]>

Signed-off-by: Jenita <[email protected]>