Cardano Updates

(cherry picked from commit a874da18c15e97766e0006c97f4025a6119da2b1)

Replace the mithril-client subcommand invocation with the standalone
snapshot-converter binary from cardano-node for converting downloaded
in-memory snapshots to LSM format.

- Add snapshot-converter to daedalus-bridge (all platforms) and expose
  daedalus-bridge in perSystem/packages for all target systems
- Thread snapshot-converter through common.nix and cardano-bridge.nix;
  include it in the aarch64-darwin codesign loop and the NSIS installer
- Add runBinary() to mithrilCommandRunner for running non-mithril
  binaries with plain process.env (no mithril env vars or origin tag)
- Rewrite _convertSnapshot to find the most recent ledger slot, build
  the LSM output paths, and invoke snapshot-converter directly
- Update tests accordingly

In fetch-installers, verify the -unsigned companion's hash against
Hydra's expected value before skipping re-download; this confirms the
companion is the genuine unsigned original and the main file is the
signed installer.

In drt sign, compare the SHA-256 of the main file against its -unsigned
companion before concluding it is already signed. On Windows, signing
renames the original before the remote nix run, so a failed signing
attempt leaves the companion on disk; if fetch-installers then
re-downloads a fresh unsigned copy both files are byte-identical and
signing must be retried rather than skipped.

(cherry picked from commit a874da18c15e97766e0006c97f4025a6119da2b1)

_convertSnapshot was added to startBootstrap after these tests were
written. Without a mock it falls through to _runCommand → buildMithrilEnv
which fetches genesis/ancillary keys from raw.githubusercontent.com,
causing EAI_AGAIN failures in network-isolated environments.

\${WIN_SIGN_HOST: -HSM} with a space causes bash to parse -HSM as a
substring-from-end offset, treating HSM as a variable. With set -u this
throws "HSM: unbound variable". The correct syntax for a default-value
substitution is \${WIN_SIGN_HOST:-HSM} (no space).

(cherry picked from commit 6a0b73f94349630e3bf0da3a3b60894eb00d95fc)

\${WIN_SIGN_HOST: -HSM} with a space causes bash to parse -HSM as a
substring-from-end offset, treating HSM as a variable. With set -u this
throws "HSM: unbound variable". The correct syntax for a default-value
substitution is \${WIN_SIGN_HOST:-HSM} (no space).

Points mithril input at sl/fix-mismatch-rust-versions branch which
ensures all craneLib instances use the rust-overlay toolchain (1.94)
rather than falling back to nixpkgs rustc (1.91), fixing Darwin builds
that fail with [email protected] requiring rustc 1.93+.

Previously hardcoded to Mainnet only, which broke when preview gained a
checkpoints file. Using NonFatal mirrors the existing pattern for
genesis-conway.json: include if present, silently skip if absent.

(cherry picked from commit a6a9ff2a2b6a494a415d72fcb6601d55d8ab4bce)

The echo line used Unicode typographic quotes around the installer path,
causing drt sign to fail to parse the 'Final installer:' line. Drop the
quotes entirely and update the Rust parser to strip only the prefix.

Also replace other curly quotes and ellipsis in the signing echo with
ASCII equivalents while here.

(cherry picked from commit 1beb91b8146146c0a76b2300534383b4cc818a7a)

Mithril now exposes a cross-compiled Windows build directly at
packages.x86_64-linux.mithril-client-cli-windows, so the previous
workaround of downloading a pre-built tarball from GitHub releases is
no longer needed.

The mithril input remains pinned to a patched branch
(sl/fix-darwin-mithril-cli) which restores Darwin builds accidentally
dropped in the latest upstream release.

Upgrade cardano-node from 10.6.2 to 10.7.1 and configure the V2LSM
ledger backend to reduce memory usage by storing UTxO data on disk
rather than in-heap. Also updates the cardano-playground config pin
and switches the config path to environments-pre/.

feat(release-cli): add Apple notarization via xcrun notarytool in drt…

Previously hardcoded to Mainnet only, which broke when preview gained a
checkpoints file. Using NonFatal mirrors the existing pattern for
genesis-conway.json: include if present, silently skip if absent.

Previously hardcoded to Mainnet only, which broke when preview gained a
checkpoints file. Using NonFatal mirrors the existing pattern for
genesis-conway.json: include if present, silently skip if absent.

(cherry picked from commit a6a9ff2a2b6a494a415d72fcb6601d55d8ab4bce)

The echo line used Unicode typographic quotes around the installer path,
causing drt sign to fail to parse the 'Final installer:' line. Drop the
quotes entirely and update the Rust parser to strip only the prefix.

Also replace other curly quotes and ellipsis in the signing echo with
ASCII equivalents while here.

(cherry picked from commit 1beb91b8146146c0a76b2300534383b4cc818a7a)

Previously hardcoded to Mainnet only, which broke when preview gained a
checkpoints file. Using NonFatal mirrors the existing pattern for
genesis-conway.json: include if present, silently skip if absent.

Each platform's signing call (nix run on OSX_SIGN_HOST, nix run for
Windows locally) is now spawned concurrently via spawn_blocking so
aarch64-darwin, x86_64-darwin, and x86_64-windows all sign in parallel
instead of sequentially.

Shared data (Meta, NotaryCreds) is wrapped in Arc to allow the 'static
closures required by spawn_blocking. Results are collected after all
tasks have been spawned, so any failure is still reported clearly.

The echo line used Unicode typographic quotes around the installer path,
causing drt sign to fail to parse the 'Final installer:' line. Drop the
quotes entirely and update the Rust parser to strip only the prefix.

Also replace other curly quotes and ellipsis in the signing echo with
ASCII equivalents while here.

Previously drt sign for Windows only piped the outer NSIS installer
through WIN_SIGN_HOST, leaving all internal .exe/.dll/.node files
unsigned. The Nix makeSignedInstaller script already had logic to sign
every binary before packaging, but drt sign bypassed it entirely.

Mirror the macOS flow: run makeSignedInstaller locally via nix run
(packages.x86_64-linux.makeSignedInstaller-{cluster}-x86_64-windows),
which signs all internal files through WIN_SIGN_HOST before invoking
NSIS, then signs the final installer. WIN_SIGN_HOST is forwarded as an
env var; the script falls back to the SSH alias HSM if unset.