Cardano Updates

Co-authored-by: teodanciu <[email protected]>

The previous outputChecks fix (9fc9f95) only removed the LLVM
validation references but left LLVM as a direct build dependency.

pkgsCross.musl64 doesn't set isStatic=true, so postgresql's
jitSupport defaults to true (canExecute returns true for same-arch
musl/glibc cross). This configures postgresql with --with-llvm,
pulling LLVM into buildInputs.

Chain both override (jitSupport=false) and overrideAttrs
(outputChecks={}, doCheck=false) to fully eliminate the LLVM
dependency that OOMs during musl cross-compilation.

On macOS builders with Determinate Nix, the build sandbox places a
read-only builder.json in the build directory. When tzdata tarballs
extract into '.' (no subdirectory), the standard makeSourcesWritable
step (chmod -R u+w .) fails trying to chmod the build directory itself
and the sandbox's builder.json file.

Set dontMakeSourcesWritable = true for tzdata in the mingw overlay,
since tar-extracted files are already writable.

The previous approach (override { jitSupport = false }) was a no-op
because jitSupport already defaults to false for musl/static builds.

The actual issue: nixpkgs-2511 postgresql/generic.nix unconditionally
includes llvmPackages.llvm in outputChecks.{out,lib}.disallowedRequisites,
regardless of jitSupport. This forces Nix to build LLVM just for output
validation checks. LLVM 20's SLPVectorizer.cpp OOMs during musl
cross-compilation (4-8 GB RAM per thread), blocking all iog-full static
builds.

Fix: clear outputChecks entirely for the musl postgresql override.

Stop committing 102MB of generated formal-spec HTML files to git.
Instead, build them on-demand during the docs workflow using nix and
enhance with the existing agda-web-docs-lib GitHub Action.

Changes:
- Add nix build steps to docs.yaml workflow to generate formal-spec HTML
- Enhance generated HTML with agda-web-docs-lib action (search, nav, themes)
- Gitignore site/static/formal-spec/ directory
- Remove 601 committed HTML files (102MB)
- Replace formal-spec-listener workflow to update flake input instead of
  committing HTML files

Benefits:
- Eliminates 102MB from git working tree
- Prevents bloating git history with regenerated files
- Formal-spec HTML is reproducibly built from pinned flake input
- Automated formal-spec updates via listener workflow

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

feat: add Copilot review guidelines in CI

GHC 9.10 added foldl' to Prelude and flags NE.unzip as
deprecated in favour of Data.Functor.unzip.

- Remove redundant foldl' imports (now in Prelude)
- Add annotateIO to MonadThrow MonadDatabase instance
  (required by io-classes MINIMAL pragma for GHC >= 9.10)

GHC 9.10 promotes -Wdata-kinds-tc to an error under -Werror when
NetworkDiscriminant is used in a kind position without DataKinds.

iserv-proxy does not support parallel module compilation — the protocol
is strictly synchronous. GHC's default -j4 causes multiple modules to
share one iserv-proxy connection, corrupting the protocol and causing
deadlocks (0% CPU hangs). Force -j1 globally for Windows builds.