Cardano Updates

Re-activate as-is in order to see if there was some changes GH sides
that solved the previous problem: logs of a retried run were lost.

@types/node@22 has setInterval return NodeJS.Timeout and clearInterval no
longer accept the legacy NodeJS.Timer, so `clearInterval(this.heartbeatInterval)`
failed to type-check (WsServer/server.ts). Retype the heartbeatInterval and
stakeInterval fields as NodeJS.Timeout | undefined.

(Masked locally by incremental tsc --build; caught on a clean CI compile.)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

The project was pinned to Node 18.12.0 (.nvmrc + all CI workflows) with a
stale `engines: >=16.20.2` — both Node 16 and 18 are EOL. Move to the current
Node 22 LTS line, tracked by major (not a stuck patch pin like 18.12.0) so it
doesn't go stale again:

- .nvmrc: 22
- all 9 CI workflows: node-version 22
- Dockerfile: NODEJS_MAJOR_VERSION=22
- engines.node: >=22 across root + all workspace manifests
- @types/node: ^18 -> ^22

Fix surfaced by @types/node@22: PerformanceEntry no longer carries `detail`
(it's on PerformanceMark/Measure) — measurement-util now casts the entry to
read it, and the mark filter is a type predicate so the target type narrows.

Unblocks the Node-20+ dependency majors (e.g. uuid@14) that previously
couldn't pass CI on Node 18.

Validated: full build green on @types/node@22; core/crypto/key-management
suites pass (sandbox runs Node 24, i.e. >=22).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

The IVC SNARK aggregation now produces the AncillaryVerifierData so
certificates carry it and the embedded IVC proof can be verified.

Pruning epoch settings before the signer registrations that reference
them broke the foreign key constraint after a large epoch gap.

Reading the verifying keys with an empty constraint system produced a
degenerate key, breaking the certificate hash round trip in the client.

The Mithril and Cardano stake distribution checks now poll until an
artifact reaches the expected epoch instead of asserting once on the latest one.

A same-epoch step does not advance the rolling state, so reuse the
parent certificate's rolling state instead of failing.

Assert the rolling state survives the AncillaryProverData CBOR round trip, and add anyhow context to the two IVC proof verification checks.