Cardano Updates

During catch-up, the chain selector could switch to a peer whose tip
was thousands of blocks behind the best known peer. This caused
pipeline stalls and dropped rollbacks that cost minutes of sync time
per cycle.

Add a check in isPeerSelectableLocked that skips peers whose tip is
more than K (securityParam) blocks behind the highest known peer tip.
Peers within K blocks may be on a legitimate fork and are still
considered. This matches the Ouroboros Praos guarantee that honest
peers are always within K blocks of the true chain tip.

Signed-off-by: wcatz <[email protected]>
Signed-off-by: wcatz <[email protected]>

SUBUTXOW fixes

## Summary
- builder-new has 24 runners, not 12
- Runner version updated to 2.331.0
- Document `MemoryMax=8G` systemd drop-in for runner cgroups
- Document `attic watch-store` memory cap at 2G

- builder-new has 24 runners, not 12
- runner version is 2.331.0
- document MemoryMax=8G systemd drop-in for runners
- document attic watch-store MemoryMax=2G

## Summary

Remove redundant dependency version bounds from
`cardano-wallet-read.cabal`. Versions are managed by nix (haskell.nix)
and `cabal.project` constraints. This was the last cabal file with
inline bounds.

Closes #5177

Three test cases for TipSlotFunc:
- Reject TX with ValidityIntervalStart beyond current tip slot
- Accept TX with ValidityIntervalStart at or below tip slot
- Bypass check when TX has no ValidityIntervalStart (start=0)

Signed-off-by: wcatz <[email protected]>
Signed-off-by: wcatz <[email protected]>

From https://github.com/IntersectMBO/plutus at 6d660700cf7d8c69a9d4b3c1c53e0d5f90ecc3d5

From https://github.com/IntersectMBO/plutus at 6d660700cf7d8c69a9d4b3c1c53e0d5f90ecc3d5