Cardano Updates

Partition dead links into two buckets with different CI treatment:

  Actionable (FAILS CI) — CHaP packages the probe couldn't resolve
    to any doc site. Usually a gap in IOG_DOC_BASES. Fix by adding
    the doc site, or by adding the package to KNOWN_UNDOCUMENTED
    if it genuinely has no published Haddocks anywhere.

  Unfixable (logged for visibility, does NOT fail CI) — three sub-
    causes, all outside this repo:
      a. Module-level 404s on otherwise-valid upstream sites.
         Empirically the cause is upstream publishing only their
         umbrella "exposed-modules" (e.g. Cardano-Binary.html) while
         Haddock generates hrefs to the defining sub-module (e.g.
         Cardano-Binary-FromCBOR.html).
      b. Packages in KNOWN_UNDOCUMENTED with no published Haddocks
         anywhere (currently kes-agent and kes-agent-crypto —
         verified no gh-pages branch, no CloudFront deployment).
      c. Haddock-emitted versionless Hackage URLs that Hackage's
         routing doesn't accept.

Add typed-protocols to IOG_DOC_BASES: its Haddocks are published at
input-output-hk.github.io/typed-protocols, which the heuristic now
reaches via the fallback list.

In GitHub Actions, actionable entries emit ::warning:: annotations so
they surface in the job UI; unfixable entries are plain log lines so
they don't flood the annotations panel. Env escape
FIX_HADDOCK_LINKS_ALLOW_DEAD=1 forces exit 0 regardless.

Rewrite the preamble to summarise the pipeline, the doc-site
resolution strategy, the rationale for skipping non-CHaP packages,
and the two-bucket CI policy with empirical justification.

Haddock resolves re-exports to the local re-export page (e.g. a reference
to cardano-ledger-byron's Address via Cardano.Api.Byron becomes
href="Cardano-Api-Byron.html#t:Address", not an external link). The
Haddock-emitted "Source" link, however, points to the cabal store path
for the original defining package. Phase 2b uses that as ground truth to
rewrite local re-export hrefs to the upstream doc site.

Also extend dead-link handling in Phase 3: before annotating a 404 as
unclickable, probe for the page under doc-site subdirectories (api/,
protocols/, framework/ — ouroboros-network's layout) and under parent
modules (Cardano-Ledger-Api-State-Query-CommitteeMembersState.html ->
Cardano-Ledger-Api-State-Query.html#t:CommitteeMembersState). If the
parent resolves, rewrite to it with a reconstructed #t: fragment so the
browser still scrolls to the definition.

On a full cardano-api build this rewrites 205 of 208 re-exported types
(up from 0) and rescues 182 of 233 previously-annotated dead links.

Fixes #601. Cross-package hrefs emitted by cabal haddock-project are
relative paths (e.g. href="../cardano-ledger-api-1.2.3-hash/Foo.html")
that don't resolve on the published site — we only host cardano-api's
own output, not its dependencies, so every cross-package reference
404s by default.

Add scripts/fix-haddock-links.sh and wire it into the github-page
workflow between haddock-project and the artifact upload. The script
replaces each cross-package href with either an absolute URL on the
upstream doc site or a tooltip-annotated unclickable <span>, so the
published site has zero clickable 404s.

Pipeline
  Phase 1: Scan filesystem, symlink versioned directories, fetch the
           CHaP index, grep HTML for cross-package link targets.
  Phase 2: Resolve each target and rewrite in place, or convert to an
           unclickable span if unresolvable.
  Phase 3: HEAD-validate rewritten URLs and annotate 404s as spans.

Doc-site resolution for CHaP packages: two lookups, first hit wins:
  1. Name-suffix heuristic under *.cardano.intersectmbo.org — strip
     trailing '-token' segments of the package name and HEAD-probe
     each candidate's doc-index.html. Covers cardano-ledger-*,
     plutus-*, ouroboros-*, etc.
  2. Fixed fallback against a small IOG_DOC_BASES list — covers
     packages whose subdomain isn't a suffix of the package name
     (e.g. cardano-base at base.cardano.intersectmbo.org).

Non-CHaP packages (bootlibs like base, bytestring, time) are NOT
linked. Haddock's per-module URL structure doesn't line up cleanly
with Hackage's (src/ source views, -inplace version suffixes from
local rebuilds) so Hackage rewrites mostly produce 404s, and readers
of cardano-api docs rarely click into bootlib internals. Rendered as
unclickable spans, no outbound link, no validation noise.

Add tests coverage for the transaction balancing with withdrawal

; Conflicts:
;	cardano-rpc/src/Cardano/Rpc/Server/Internal/UtxoRpc/Query.hs
;	cardano-rpc/src/Cardano/Rpc/Server/Internal/UtxoRpc/Submit.hs
;	cardano-rpc/src/Cardano/Rpc/Server/Internal/UtxoRpc/Type.hs

All Dijkstra-era placeholder `error` messages and `TODO` comments in
`cardano-api/src/` now share the greppable token `TODO Dijkstra:`, so a
single `grep -r 'TODO Dijkstra'` locates every site that needs attention
when Dijkstra-era support lands. No behaviour change; this is a pure
message/comment unification across 30 sites in 16 files.

The runtime invariant assertion at `Tx/Internal/Body.hs:2858`
(`toScriptIndexDijkstra: unexpected DijkstraGuarding`) is intentionally
untouched — it is an impossible-case assertion, not a
pending-implementation stub.

The PlutusV4 placeholder at `Plutus/Internal/Script.hs:1302`
(`toShelleyScript: PlutusV4 not implemented yet.`) is tracked
separately as it blocks on ledger exposing a PlutusV4 constructor.

Haddock resolves re-exports to the local re-export page (e.g. a reference
to cardano-ledger-byron's Address via Cardano.Api.Byron becomes
href="Cardano-Api-Byron.html#t:Address", not an external link). The
Haddock-emitted "Source" link, however, points to the cabal store path
for the original defining package. Phase 2b uses that as ground truth to
rewrite local re-export hrefs to the upstream doc site.

Also extend dead-link handling in Phase 3: before annotating a 404 as
unclickable, probe for the page under doc-site subdirectories (api/,
protocols/, framework/ — ouroboros-network's layout) and under parent
modules (Cardano-Ledger-Api-State-Query-CommitteeMembersState.html ->
Cardano-Ledger-Api-State-Query.html#t:CommitteeMembersState). If the
parent resolves, rewrite to it with a reconstructed #t: fragment so the
browser still scrolls to the definition.

On a full cardano-api build this rewrites 205 of 208 re-exported types
(up from 0) and rescues 182 of 233 previously-annotated dead links.

- Remove UpdateProposal CBOR roundtrip test since EraBasedProtocolParametersUpdate
  has stub ToCBOR/FromCBOR instances
- Set cost models to SNothing in genAlonzoOnwardsPParams since cost models
  don't survive CBOR roundtrip (matching the old generator behaviour)
- Fix unused import in Shared.hs

All Dijkstra-era placeholder `error` messages and `TODO` comments in
`cardano-api/src/` now share the greppable token `TODO Dijkstra:`, so a
single `grep -r 'TODO Dijkstra'` locates every site that needs attention
when Dijkstra-era support lands. No behaviour change; this is a pure
message/comment unification across 30 sites in 16 files.

The runtime invariant assertion at `Tx/Internal/Body.hs:2858`
(`toScriptIndexDijkstra: unexpected DijkstraGuarding`) is intentionally
untouched — it is an impossible-case assertion, not a
pending-implementation stub.

The PlutusV4 placeholder at `Plutus/Internal/Script.hs:1302`
(`toShelleyScript: PlutusV4 not implemented yet.`) is tracked
separately as it blocks on ledger exposing a PlutusV4 constructor.

Add per-era FromJSON instances for the experimental TxOut type,
mirroring the ToJSON structure. Pre-Alonzo eras parse address and
value only; Alonzo adds datum hash support; Babbage+ adds inline
datum (parsed from inlineDatumRaw with hash validation) and
reference script support. Supplemental datums are deliberately
unsupported as the ledger TxOut does not carry them.

Add HasCallStack constraints to functions containing error calls