Cardano Updates

The pinned cardano-balance-transaction (98e7f41) still depends on
cardano-api. Add US1 as a gate: pin the cardano-api-free version
first. Document the breaking API changes (CardanoApiEra removal,
toCardanoApiTx/fromCardanoApiTx removal) that cascade into wallet
transaction, delegation, and voting code.

Rewrite spec starting from current master state where
cardano-balance-transaction and cardano-coin-selection are already
extracted. Focus on the remaining 71 imports across 45 files.
Added context section, test generator migration story (US5),
Byron support requirement (FR-013).

Spec covers the full removal across 6 phases: ledger re-exports,
TxMetadata, NetworkId, certificates, SealedTx, and tx submission.

## Summary
- builder-new has 24 runners, not 12
- Runner version updated to 2.331.0
- Document `MemoryMax=8G` systemd drop-in for runner cgroups
- Document `attic watch-store` memory cap at 2G

- builder-new has 24 runners, not 12
- runner version is 2.331.0
- document MemoryMax=8G systemd drop-in for runners
- document attic watch-store MemoryMax=2G

## Summary

Remove redundant dependency version bounds from
`cardano-wallet-read.cabal`. Versions are managed by nix (haskell.nix)
and `cabal.project` constraints. This was the last cabal file with
inline bounds.

Closes #5177

The push step assumed the loaded image tag matches
RELEASE_CABAL_VERSION, but the nix-built image embeds
the compile-time cabal version which may differ. Parse
the actual tag from docker load output instead.

If the release-candidate branch was not merged back to master
after a release, the cabal files will have the wrong version.
The sed replacement will silently match nothing, and the release
will ship binaries with a stale version string.

Detect this upfront and fail with a clear error message telling
the operator to merge the RC branch back first.

The smoke test must verify that the binary reports the expected
release version. If nix serves a stale cached build, this catches
it before the release ships.

The release-candidate script derived OLD_CABAL_VERSION from the
latest git tag, but the cabal files can drift from the tag (e.g.
v2026-03-31 shipped with cabal version 0.2025.12.15). This caused
sed to find no matches, leaving the cabal files unbumped and the
release binary reporting the wrong version.

Read the version directly from cardano-wallet.cabal instead.

The embedded version comes from compile-time cabal metadata,
not the release tag. Just verify the binary executes successfully.

Add Linux and Windows E2E test jobs to the release workflow.
They only run when release_type == 'release' (skipped for nightlies).
create-release is gated on E2E passing for real releases.

Linux E2E: runs against preprod via mithril snapshot.
Windows E2E: cross-compiles E2E bundle, runs on windows-latest.

Binaries are at the root of the archive directory
(e.g. cardano-wallet-v2025-12-15-linux64/cardano-wallet),
not under bin/. Use find to locate them.

- Fix upload() function: pass file extension instead of quoted glob
  pattern that broke shell expansion, causing assets to silently
  fail to upload
- Add verify-artifacts job between build and release: extracts
  archives, checks binary exists, runs version smoke test
  (Linux/macOS only — Windows can't execute on Linux runner)
- Bump download-artifact v4 → v8
- create-release now depends on verify-artifacts

Closes #5223

Dependency versions are managed by nix (haskell.nix) and
cabal.project constraints. The .cabal bounds were redundant
and added maintenance cost during dependency bumps.

Closes #5177

## Summary

- Bump cardano-node runtime from 10.6.2 to 10.6.3
- cardano-crypto 1.2.0 → 1.3.0 (bounds relaxation only, no API changes)
- CHaP index-state 2026-02-09 → 2026-03-28 (target HSEC-2025-0002)
- All other Cardano dependency versions unchanged

Closes #5230

- cardano-crypto 1.2.0 → 1.3.0 (bounds relaxation only)
- CHaP index-state 2026-02-09 → 2026-03-28
- All other dependency versions unchanged

Add Linux and Windows E2E test jobs to the release workflow.
They only run when release_type == 'release' (skipped for nightlies).
create-release is gated on E2E passing for real releases.

Linux E2E: runs against preprod via mithril snapshot.
Windows E2E: cross-compiles E2E bundle, runs on windows-latest.