Cardano Updates

Mirrors `LinearWithTxReferences`'s CIP-0164 receiver gate: an EB
can only be validated once every referenced tx body is in the
local mempool.  Two side maps thread the dependency:

- `eb_pending_txs: EBId → BTreeSet<TxId>` — per-EB still-missing set
- `missing_tx_index: TxId → BTreeSet<EBId>` — reverse index for
  the tx-admit release path

`finish_validating_eb_header` now computes `missing` against
`mempool.has_tx` (union of free pool + EB-pinned bodies) and
either schedules `EBBlockValidated` immediately or stashes the EB
pending in both maps.  `acknowledge_tx_for_pending_ebs` walks the
reverse index after every successful `admit_validated` and
releases EBs whose set reaches empty.  Chain-prune sweeps both
maps in lockstep with the existing `self.ebs` retention.

Empirical note: NA,0.350 / wfa-ls / 750n / -s 1500 produces
bit-identical results with and without the gate (88/15/33/42084
either way), because tx diffusion is fast enough in this sim that
every receiver already has the bodies in mempool before the EB
arrives.  The gate matters in regimes where Message::Tx lags
Message::EB (cluster-scale net-rs, withheld-tx attacks, or once
the upcoming sim message split surfaces a real manifest-only
intermediate state).  It's the protocol-correct behaviour either
way — without it, an EB could in principle validate and open
voting before any voter has the bodies, an outcome the
CIP-0164 MissingTX predicate is supposed to prevent at validation
time, not just at decide-vote time.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

The `cloud-agent/client/typescript` directory is fully gitignored
(root .gitignore:24), because its content — OpenAPI generator output
and lockfiles — is generated by `yarn generate:all` and not tracked
in the repo (the manually-maintained package.json is the lone tracked
exception, kept tracked because it was committed before the ignore
rule was added).

Listing this directory in dependabot.yml causes Dependabot to attempt
to commit a regenerated lockfile, which `git add` rejects with
"The following paths are ignored by one of your .gitignore files".
The Dependabot Updates workflow has been failing on this for weeks
as a result.

Drop the directory from the npm-prod-deps group. The handful of
runtime/dev deps in typescript/package.json (es6-promise, url-parse,
whatwg-fetch, typescript, @types/url-parse) are template-like and
can be updated manually when needed.

Signed-off-by: Yurii Shynbuiev <[email protected]>

Signed-off-by: KtorZ <[email protected]>

chore(nix): update `flake.lock`

Snapshot of input-output-hk/lace-platform @ 8abaeff5173f18896aee8c5833693240693b4782
Produced by open-source-release-publish.yml.

See PROVENANCE for the allowlist hash that controlled this snapshot.