Cardano Updates

Enumerates every remaining caller of the deprecated surface after
#5271: production (Cardano.Wallet.hs, Server.hs), old tx builder
(Shelley/Transaction.hs, partially overlaps with #5243), integration
tests (Shared/Transactions.hs, addRequiredSigners in TransactionsNew)
and unit tests (TransactionSpec, TransactionLedgerSpec).

Organises the work into three phases:
  A. reachable without #5243 (4 sites)
  B. unit-test migration (~20 sites, two files)
  C. delete the bridge functions and the three Cardano.Api*
     imports in SealedTx.hs

The function has been an ADP-3077 TODO stub (error "...") for a long
time; the commented-out cardano-api body still referenced
getSealedTxBody and sealedTxFromCardanoBody, which blocks their
removal. Drop the dead block and note that a future implementation
should operate on Read.Tx era via reqSignerHashesTxBodyL.

Server.hs carried a local copy of sealWriteTx that re-entered
cardano-api (toCardanoApiTx + sealedTxFromCardano) to wrap an already
ledger-native balanceTx result. Import the ledger-native sealWriteTx
from Transaction.Ledger instead; the local helper goes away. Two call
sites now pass Write.recentEra explicitly.

Drops the cardano-api bridges cardanoEraFromRecentEra, toCardanoApiTx
and W.sealedTxFromCardano from this module's imports.

Mirror the TransactionsNew.hs:getMetadataFromTx port: project metadata
directly from Read.Tx era via Meta.getMetadata . Meta.getEraMetadata
instead of round-tripping through cardano-api. Drops the two callers
of cardanoTxIdeallyNoLaterThan in this file and the Cardano.Api /
ApiEra qualified imports.

The signedTx wrapping in Cardano.Wallet went through
toCardanoApiTx -> inAnyCardanoEra -> sealedTxFromCardano purely to
smuggle the already-ledger tx back through cardano-api. Use the
existing ledger-native sealWriteTx from Transaction.Ledger instead
(now exported). Drops the two cardano-api bridges inAnyCardanoEra and
sealedTxFromCardano from this module.

Also refresh the sealWriteTx haddock (the function has been ledger-
native since the last revamp; the stale comment claimed otherwise).

Following the migration of parsePartialTx to deserializeTx,
cardanoTxInExactEra has no external callers. Remove it along
with the now-redundant Data.Data import in SealedTx.hs.

Introduce sealedTxFromLedgerTx :: Read.IsEra era => Read.Tx era -> SealedTx.
Serialises via Read.serializeTx (ledger-native) and wraps in EraValue
without any cardano-api involvement.

Migrate sealWriteTx in Transaction.Ledger.hs to use the new
constructor, pattern-matching on RecentEra to witness the era.
Removes the toCardanoApiTx -> sealedTxFromCardano' roundtrip,
dropping the Cardano.Api.Extra import from that module.

Step 2a of SealedTx decommission plan.

Introduce sealedTxWitnessCount :: SealedTx -> Int, counting VKey
plus bootstrap witnesses via 'addrTxWitsL'/'bootAddrTxWitsL' on the
stored 'EraValue Read.Tx'. Byron txs counted as 0 (wallet doesn't
construct them through SealedTx).

Migrate Server.hs's two 'length $ getSealedTxWitnesses sealedTx'
sites (redeemer and witness accounting) to use it. Drops
'getSealedTxWitnesses' from Server.hs's import list.

Step 2b of SealedTx decommission plan.

Replace cardanoTxInExactEra (cardano-api path) with
deserializeTx (ledger-native) in the redeemer-bearing
partial tx parser. Pattern-matches on RecentEra era so
the era singleton witnesses the target ledger type.

One fewer caller of cardano-api's
'deserialiseFromCBOR / InAnyCardanoEra Cardano.Tx' path.
'fromCardanoApiTx' → direct use of 'Read.Tx era' unwrapped
into 'Write.Tx era'.

Replace cardano-api round-trip with direct Read.Tx era projection via
Meta.getMetadata . Meta.getEraMetadata. Drops the four callers of
cardanoTxIdeallyNoLaterThan in this file (the cardano-api re-decode
was only used to feed getTxBody/txMetadata).

No behavioural change: the ledger metadata path is what Server.hs and
DB.TransactionInfo already use.

Replace compareOnCBOR's roundtrip through cardano-api
(cardanoTx → Cardano.serialiseToCBOR) with the raw bytes
already stored in SealedTx.serialisedTx. Identical
comparison outcome, one fewer caller of
cardanoTxIdeallyNoLaterThan. Step 1 of SealedTx
decommission plan.

Five-step plan to remove the three remaining Cardano.Api imports from
lib/primitive/lib/Cardano/Wallet/Primitive/Types/Tx/SealedTx.hs by
eliminating the bridge functions (cardanoTxIdeallyNoLaterThan,
cardanoTxInExactEra, sealedTxFromCardano*, getSealedTxBody,
getSealedTxWitnesses, cardanoApiTxToReadTx).

Replace the cardano-api path
(SealedTx → unsealShelleyTx → TxInMode → toConsensusGenTx → GenTx)
with a direct ledger-native path
(SealedTx → unsafeReadTx :: EraValue Read.Tx → consensusGenTxFromTxRecent → GenTx).

The stored 'EraValue Read.Tx' already knows its era, so the
separate 'readCurrentEra' query is no longer needed, and
'TxInMode' / 'toConsensusGenTx' / 'unsealShelleyTx' /
'UnsealException' all become unused.

Deletes:
  - Cardano.Wallet.Primitive.Ledger.Shelley.unsealShelleyTx
  - Cardano.Wallet.Primitive.Ledger.Shelley.UnsealException
  - cardano-api 'TxInMode' import in primitive
  - cardano-api 'toConsensusGenTx' import in network-layer

Adds 'unsafeReadTx' to the re-export of 'SealedTx' in
Cardano.Wallet.Primitive.Types.Tx. Step 1 of SealedTx decommission
plan. One fewer caller of 'cardanoTxIdeallyNoLaterThan'; the
submission path no longer touches cardano-api.

## Summary

**Foundation layer** of the cardano-api removal (phase A of the split of
#5236). Adds wallet-owned types and ledger-native builders **without
switching any existing call site** — the new code paths exist alongside
the cardano-api paths and are only exercised by the new test duplicate.
Low risk, reviewable in one sitting.

Companion PR (call-site migration) will be opened against this branch
once merged. The review-response commit also tightens one existing
address-network-tag helper to delegate the mainnet/testnet bit to
ledger, with unchanged semantics.

## What lands here (15 commits, all bisect-safe)

| # | SHA | Purpose |
|---|---|---|
| 1–4 | docs | spec / plan / tasks artifacts (speckit) under
`specs/001-drop-cardano-api/` |
| 5 | `7307a0fe` | Add the initial `SNetworkId n -> Ledger.Network`
conversion, now exposed as `sNetworkIdToLedger` after review feedback |
| 6 | `e1a1acaf` | Rewrite `SealedTx` internals to `EraValue Read.Tx`
(previous cardano-api reconstruction helpers retained as temporary
bridges) |
| 7 | `fd5fe22f` | Replace `Cardano.Api.NetworkId` with wallet-owned
`NetworkId` in 4 files |
| 8 | `393eaa28` | Add wallet-owned `TxMetadata` module
(`lib/primitive/.../Types/Tx/TxMetadata.hs`) with JSON schema conversion
ported from cardano-api |
| 9 | `92a7699d` | Add `Transaction.Build.mkLedgerTx` — builds a ledger
`Tx era` from its components using `mkBasicTxBody` + lenses |
| 10 | `726656ab` | Add `Transaction.Ledger` — ledger-native tx
construction (`mkTransactionLedger`, `constructUnsignedTxLedger`,
`buildLedgerTx`, `TxPayload`, `mkRewardAccount`) |
| 11 | `68e441c5` | Complete `Transaction.Ledger` exports |
| 12 | `13e76caa` | Duplicate `TransactionSpec.hs` →
`TransactionLedgerSpec.hs` as baseline for exercising the new builder in
tests |
| 13 | `984e8177` | Add ledger-native cert helpers:
`certificateFromDelegationActionLedger`,
`certificateFromVotingActionLedger`, `toLedgerStakeCred`, `toLedgerCoin`
|
| 14 | `d8e74e41` | Wire ledger-native witness construction
(`mkShelleyWitnessLedger`, `mkByronWitnessLedger`) into
`TransactionLedgerSpec` |
| 15 | `2e210821` | Address reviewer feedback: use
`Ledger.networkToWord8` for address network tags; document wallet
`NetworkId` vs ledger `Network`; try Dijkstra in ledger-native
`SealedTx` decode; document why `TxMetadata` keeps the
wallet/cardano-api-compatible surface while converting to ledger
metadata internally |

## Ledger 1.19/1.20 adaptations applied

- `Ledger.Tx era` → `Write.Tx era` (balance-tx's `type Tx era = Core.Tx
Core.TopTx era` alias for the 1.19 `TxLevel` kind lift)
- `Ledger.TxBody era` → `Write.TxBody era`
- `Ledger.RewardAccount` pattern synonym → `Ledger.AccountAddress
(Ledger.AccountId …)` (1.20 rename)
- `KeyRole (Witness)` import → `Keys.Witness` qualified (1.20 reorg —
`Witness` is a standalone type, not a `KeyRole` data constructor)
- `hashAnnotated body` → `hashAnnotated @_ @EraIndependentTxBody body`
(1.20 `HashAnnotated x i | x -> i` functional dep can't resolve through
`Write.TxBody era` type synonym)

## What is NOT in this PR

- No transaction construction, `balanceTx`, signing, cert construction,
or `TxMetadata` consumer migration lands here. Those paths still go
through cardano-api; the new ledger-native paths sit alongside for now.
The only existing-path tweak is the equivalent `postAnyAddress` network
tag helper change from manual 1/0 matching to `Ledger.networkToWord8`.
- No bridges are added or removed: `Cardano.Api.Extra` shim,
`sealWriteTx`, and `certToLedger`/`unCert` helpers are untouched.
- No cabal changes to drop `cardano-api` (the dependency is still pulled
in by the unchanged call sites).

## Per-commit CI gate

The original 14 commits were gated through `fourmolu --mode check` +
`hlint lib` + `nix build .#cardano-wallet` and PASS individually.

The review-response commit `2e210821` was checked with direct Fourmolu
on the touched Haskell files and a library-only Cabal build of
`cardano-wallet-primitive`, `cardano-wallet-api`, and `cardano-wallet`
inside `nix develop`. The stricter `just build` path currently stops in
pre-existing `cardano-wallet-read` warnings promoted to errors before
reaching the changed modules.

## Test plan

Review response:
- [x] `nix develop --command fourmolu --mode check` on touched Haskell
files
- [x] `nix develop --command cabal build lib:cardano-wallet-primitive
lib:cardano-wallet-api lib:cardano-wallet -O0 -v0`
- [ ] `nix develop --command just build 'cardano-wallet-primitive
cardano-wallet-api cardano-wallet'` with `-Werror` is blocked by
pre-existing `cardano-wallet-read` warnings

Original branch:

- [x] `nix build .#cardano-wallet` succeeds at every commit
(bisect-safe)
- [x] `fourmolu --mode check` clean
- [x] `hlint lib` no hints
- [x] Full `build-gate (Linux)` CI on the previous tip before
review-response commit
- [ ] Full CI on the new review-response tip
- [x] `unit-cardano-wallet-unit` test suite (deferred to CI)

Server.hs carried a local copy of sealWriteTx that re-entered
cardano-api (toCardanoApiTx + sealedTxFromCardano) to wrap an already
ledger-native balanceTx result. Import the ledger-native sealWriteTx
from Transaction.Ledger instead; the local helper goes away. Two call
sites now pass Write.recentEra explicitly.

Drops the cardano-api bridges cardanoEraFromRecentEra, toCardanoApiTx
and W.sealedTxFromCardano from this module's imports.

The signedTx wrapping in Cardano.Wallet went through
toCardanoApiTx -> inAnyCardanoEra -> sealedTxFromCardano purely to
smuggle the already-ledger tx back through cardano-api. Use the
existing ledger-native sealWriteTx from Transaction.Ledger instead
(now exported). Drops the two cardano-api bridges inAnyCardanoEra and
sealedTxFromCardano from this module.

Also refresh the sealWriteTx haddock (the function has been ledger-
native since the last revamp; the stale comment claimed otherwise).

The function has been an ADP-3077 TODO stub (error "...") for a long
time; the commented-out cardano-api body still referenced
getSealedTxBody and sealedTxFromCardanoBody, which blocks their
removal. Drop the dead block and note that a future implementation
should operate on Read.Tx era via reqSignerHashesTxBodyL.

Mirror the TransactionsNew.hs:getMetadataFromTx port: project metadata
directly from Read.Tx era via Meta.getMetadata . Meta.getEraMetadata
instead of round-tripping through cardano-api. Drops the two callers
of cardanoTxIdeallyNoLaterThan in this file and the Cardano.Api /
ApiEra qualified imports.

Replace cardano-api round-trip with direct Read.Tx era projection via
Meta.getMetadata . Meta.getEraMetadata. Drops the four callers of
cardanoTxIdeallyNoLaterThan in this file (the cardano-api re-decode
was only used to feed getTxBody/txMetadata).

No behavioural change: the ledger metadata path is what Server.hs and
DB.TransactionInfo already use.