Cardano Updates

Verify that independently replaying a node's final chain from genesis
produces the same ledger state as the one computed by the ChainDB
during the simulation. No existing ThreadNet test checks this.

From https://github.com/IntersectMBO/ouroboros-consensus at 2fd41a5a79a03578b3bcd8ab8f64526add39f8cb

Points the haskellNix flake input in `nix-tools` back at the master branch (now that #2491 has been merged).

* Use rsync --chmod=u+w to fix builds on VirtioFS-backed stores

Apple's VirtioFS (used by nix-linux-builder for Linux-on-Darwin builds)
does not honor Linux DAC_OVERRIDE. When rsync -a copies from read-only
Nix store paths, it preserves the 555 directory permissions, creating
truly unwritable directories on VirtioFS. Subsequent file writes into
these directories fail with EACCES.

Adding --chmod=u+w to rsync makes directories owner-writable as they
are created, preventing the permission lockout. This is a no-op on
native Linux where DAC_OVERRIDE already grants write access regardless
of directory permissions.

The separate chmod -R +w calls are no longer needed since rsync now
sets the correct permissions during copy.

* cd nix-tools && nix flake update haskellNix --override-input haskellNix github:input-output-hk/haskell.nix/angerman/fix-rsync-virtiofs-permissions

Needed to fix hydra eval error

---------

Co-authored-by: Hamish Mackenzie <[email protected]>

This also requires setting the decentralisation parameter `ppD` to `< 1`
so pools can produce blocks as well. We set it to `minBound` which means
that the network is full decentralised.

See: #5477

All crypto operations (hashing, KDF, HMAC, symmetric encryption,
Ed25519, extended key ops, RNG, CRC32) are now accessed through
a single facade module. This creates a clean seam for swapping
the crypto backend (e.g. libsodium for WASM, pure-Haskell, or
WebCrypto for JS).

No semantic changes — this is a pure refactor.

Update TestNewOuroboros_DefaultRateLimit to expect nil rate limiter
when default is -1 (disabled). Update cleanup test to explicitly
configure the rate limiter since it's no longer created by default.

Signed-off-by: wcatz <[email protected]>
Signed-off-by: wcatz <[email protected]>

Fix missed version bump for allegra package