Cardano Updates

The nightly scheduled run has failed at 'Install moog' every cron tick
since moog 0.5.x dropped the moog-*-linux64.tar.gz asset (last green
2026-06-01). Replace the get-latest-release + release-downloader actions
with a gh release download that picks the statically-linked
moog-*-x86_64-linux-musl.tar.gz, filtering out the agent/oracle tarballs.

Also add an 'Alert on scheduled failure' step (issues:write) that opens
or appends to a single tracking issue, so a silently-failing nightly run
becomes visible instead of rotting for days.

Port the bash coverage assertions to the cardano-clusterlib drivers:
anytime_chain_progress perturbation witness, gov_op_under_perturbation,
action_voted_by_all_roles / action_majority_reached (with details),
action_lifecycle_closed, committee_quorum_maintained, plus the
set_chain_verdict/recent_stall helpers and sdk setup_complete + details.

Turn the Sometimes-assertion set into a real coverage scorecard:
- anytime_chain_progress: perturbation witness — samples relay1's tip
  over a 20s window; chain_stalled_under_fault goes green only when
  faults actually halted block production, chain_producing when it
  recovers. Publishes a verdict the create/vote drivers read.
- create/vote: gov_op_under_perturbation when an op lands during a stall.
- vote: condition-bearing action_voted_by_all_roles + action_majority_
  reached (with details), action_lifecycle_closed on vote rejection.
- anytime_govstate: committee_quorum_maintained Always-invariant.
- helper_sdk: sdk_setup_complete lifecycle helper.
- helper_gov: set_chain_verdict / recent_stall.

Adds components/gov-cli/INSTRUMENTATION.md documenting the full signal
surface and how to read the coverage scorecard. Validated locally:
condition-bearing Sometimes flip green only when the state is reached
(majority at 6/6; all-roles once drep+spo+cc present).

* mithril-stm from `0.10.28` to `0.10.29`

Grafana improvements

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>

On cross, `buildToolSlices` are the build-build (pkgsBuildBuild) tool
slices.  They were added to `depSlices` -> `propagatedBuildInputs`, so
the build-time slicing-repo composer walked their `repo-frag` (source
tarball + index .cabal) into the cross slice's hackage repo, alongside
the cross tool's repo-frag.  cabal then saw two candidates for the tool
(e.g. a build-build `hsc2hs-0.68.10` and the cross one); a dependent's
build-tool exe-dep could resolve to the build-build unit, whose UnitId
feeds the consumer's cross UnitId but never appears in its Setup
configure args.  That forked dependent unit-ids (e.g. network) away from
what cabal computes elsewhere, so `checkAgainstPlan` failed in any slice
depending on a build-tool-using package -- breaking the whole
aarch64/armv7a-android-prebuilt suite (via iserv-proxy) and other cross
targets.

On cross the tool's cross store unit already comes from
`transitiveBuildToolSlices` (the cross `targetSlice`) and its runnable
binary from `buildToolBinOverlays` / `withProgFlags` (both reference
`buildSlice` directly), so the build-build slices must stay out of
`propagatedBuildInputs` here.

Adds a fyne-free notifications engine that derives one rule per (kind,
param) from a multi-target SetupPlan (Wallets/DReps/Pools/
MonitorEverything) and emits Requests through a tumbling-window rate
limiter; connection alerts bypass it. The wizard gains three editable
target sections with cross-template validation hints, overwrites
notify_prefs on Apply, and no longer blocks finishing on the macOS
test notification. Removes tray/adder_config.go (dead code — only its
own tests called it; the live SetupPlan→YAML path is
setup/codec.go::ToEngineConfig).

Implements #685

Signed-off-by: Ales Verbic <[email protected]>

Address review feedback on the Conway build test harness:

- Strengthen multi_asset_output_is_deterministic / mint_is_deterministic to
  assert a single unique encoding across 64 fresh builds (collected into a
  HashSet) and to stage two asset names under one policy, so both the outer
  (policy) and inner (asset-name) BTreeMap sorts are exercised. Each build
  constructs a fresh, per-instance re-seeded HashMap, which is what drives the
  pre-encode order variation; the previous form compared one fixed-order build
  to itself and never varied the bundle order.
- Assert bundle sizes in output_asset_value_round_trips and
  mint_and_burn_round_trip so a spuriously added asset/policy cannot slip past
  the single-entry .next() checks.
- Reword the script_data_hash_matches_recomputation doc comment to make clear it
  is a self-consistency check, not a cross-check against cardano-cli (it reuses
  the builder's legacy list-form redeemer encoding).
- Remove the [dev-dependencies] block from pallas-txbuilder/Cargo.toml:
  pallas-crypto, pallas-primitives, pallas-addresses, and hex are all already in
  [dependencies], which Cargo makes available to integration tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.282.0 to 0.283.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.282.0...v0.283.0)

---
updated-dependencies:
- dependency-name: google.golang.org/api
  dependency-version: 0.283.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

Bumps [cloud.google.com/go/secretmanager](https://github.com/googleapis/google-cloud-go) from 1.16.0 to 1.20.0.
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/documentai/CHANGES.md)
- [Commits](https://github.com/googleapis/google-cloud-go/compare/kms/v1.16.0...dlp/v1.20.0)

---
updated-dependencies:
- dependency-name: cloud.google.com/go/secretmanager
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>

Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.44.3 to 1.51.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.44.3...v1.51.0)

---
updated-dependencies:
- dependency-name: modernc.org/sqlite
  dependency-version: 1.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>