Cardano Updates

`modules/configuration-nix.nix` used to unconditionally `mkForce`
`packages.ghc.src` to a symlinkJoin of `(configured-src + generated)`
under `compiler/`, redirecting `lib:ghc`'s source to the local GHC
tree *after* plan-nix had been computed against hackage's
`ghc-X.Y.Z.tar.gz`.  v1 (Setup.hs) didn't care — it builds whatever
`src` it's given.  v2 forks the slice's UnitId from plan-nix's
recorded one (the slice rebuilds from a different source than the
planner saw) and the slice fails its UnitId check.

Replace with an opt-in project-level flag, `useLocalGhcLib`, that
exposes the GHC compiler tree to the planner up-front.  Mechanism
differs by project type:

  * Cabal projects (modules/cabal-project.nix) inject a
    `source-repository-package` block + `allow-boot-library-installs:
    True` into `cabalProjectLocal`, with an `inputMap` entry keyed
    by `<url>/<ref>` (string-context-stripped) so haskell.nix
    short-circuits the `builtins.fetchGit` path.  Plan-to-nix and
    the v2 slice both see the same wrapped repo, cabal hashes the
    same content into `pkg-src-sha256`, and UnitIds align.

  * Stack projects (modules/stack-project.nix) re-add the
    `packages.ghc.src` override as a contributed module, gated on
    `useLocalGhcLib`.  Stack-to-nix's input shape doesn't fit the
    cabal source-repo path; instead we lean on stack only supporting
    v1 for now (`builderVersion = mkForce 1` in stack-project.nix's
    config) — v1 doesn't enforce UnitId alignment, so the post-plan
    swap is fine.

The option itself lives in `modules/project-common.nix` so both
project types see it without duplication.

`builder/comp-v2-builder.nix` emits `allow-boot-library-installs:
True` in the slice's cabal.project whenever the target or any non-
pre-existing lib dep is on cabal-install's hard-coded
non-reinstallable list (`ghc`, `template-haskell`, `Cabal`,
`Cabal-syntax`, `ghc-prim`, `ghc-bignum`, `ghc-boot`,
`ghc-boot-th`, `ghc-heap`, `base`, `ghci`, `ghc-internal`, `rts`).
Without it the slice's solver rejects the source instance with
"constraint from non-reinstallable package requires installed
instance" once `ghc` is being source-built.

`test/ghc-lib-reinstallable/cabal.nix` and
`test/ghc-lib-reinstallable/stack.nix` opt in via
`useLocalGhcLib = true`.  The stack test's resolver is bumped to
`nightly-2026-05-03` (latest known to the pinned stackage.nix at
the time of this commit).

Verified end-to-end:
  * `tests.ghc-lib-reinstallable-cabal.run` (v2, ghc9141) — passes
  * `tests.ghc-lib-reinstallable-cabal.run` (v1, ghc9141) — passes
  * `tests.ghc-lib-reinstallable-stack.run` (v1, ghc9124) — passes

Replace the generic FindDIDSigningKeys with six explicit, purpose-specific classes:
- FindIssuerSigningKeys: for credential issuance (assertionMethod)
- FindAuthenticationSigningKeys: for proving DID ownership (authentication)
- FindKeyAgreementSigningKeys: for encryption/key agreement (keyAgreement)
- FindCapabilityInvocationSigningKeys: for invoking delegated capabilities
- FindCapabilityDelegationSigningKeys: for delegating capabilities to others
- FindRevocationSigningKeys: for revoking credentials/keys

This improves code clarity and scalability by making the purpose of each key
type explicit at the API level. Each search function includes comprehensive
W3C DID Core Specification references and documentation.

All explicit finders are thin wrappers delegating to the refactored
FindSigningKeys implementation that now supports all six DID verification
relationships via PURPOSE_TO_VERIFICATION_RELATIONSHIP mapping.

Fixes #596

Signed-off-by: Anshika Chaubey <[email protected]>

NumericDate claims per RFC 7519 must be emitted in seconds, not milliseconds.
Several SDK code paths were using Date.now() directly, which returns milliseconds,
causing tokens to be emitted with iat/exp values interpreted as far-future dates
when conforming verifiers parse them as seconds. This breaks interoperability with
RFC 7519-compliant consumers.

Fixed affected sites:
- HandleRequestCredential.ts: createJWT() and createSDJWT() methods
- CreateCredentialRequest.ts: OID4VCI proof JWT

All NumericDate claims now use Math.floor(Date.now() / 1000) to emit seconds.

Tests added to verify iat/exp are in seconds (NumericDate range):
- HandleRequestCredential.test.ts: RFC 7519 NumericDate Compliance tests
- CreateCredentialRequest.test.ts: OIDC proof JWT iat seconds validation

Fixes #610

Signed-off-by: Anshika Chaubey <[email protected]>

Switch `ChainData` and `Attributes` to use `ByteArray`

In order to avoid pinned memory fragmentation it is beneficial to use
`ByteArray` instead of `ByteString`

Implement `EncCBORGroup` instance for `DijkstraBlockBody`